CVE-2026-102894 gpustack CVE debrief

Who should care

System administrators and security teams managing GPUStack deployments for AI model serving and GPU instance provisioning should assess exposure and apply patches immediately to prevent potential unauthorized access and data tampering. They should review authentication configurations and user provisioning, and monitor for suspicious activity and potential misuse.

Why it matters

CVE-2026-102894 is a critical vulnerability in GPUStack that allows for authentication bypass and unauthorized user provisioning. System administrators and security teams managing GPUStack deployments should assess exposure and apply patches immediately to prevent potential unauthorized access and data tampering.

• Potential for unauthorized access to sensitive AI model serving and GPU instance provisioning systems
• Risk of lateral movement within compromised environments
• Need for verification of authentication configurations and user provisioning
• Potential for data tampering or exposure

Technical summary

The /auth/saml/callback endpoint in GPUStack fails to verify SAML response signatures, allowing for authentication bypass and unauthorized user provisioning. This issue is fixed in version 2.2.2. The vulnerability enables any network client to submit an identity for an existing user or provision a new non-administrator account. Response and Assertion identifiers are not consumed, allowing captured signed responses to be replayed. Immediate assessment and patching are recommended for systems using GPUStack for AI model serving and GPU instance provisioning.

Defensive priority

High priority for systems using GPUStack for AI model serving and GPU instance provisioning. Immediate assessment and patching recommended.

Recommended defensive actions

• Assess exposure and verify inventory of GPUStack deployments
• Apply patch to version 2.2.2 or later
• Review and update authentication configurations for SAML
• Monitor for suspicious activity and potential misuse
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the exact scope of affected deployments and potential impact require further verification from official sources. Affected product deployments need to be confirmed in managed environments, with an owner assigned for follow-up. Official advisories or CVE records should be reviewed to validate affected scope, severity, and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.