CVE-2026-103002 gpustack CVE debrief

Who should care

Defenders responsible for Kubernetes clusters using GPUStack should assess exposure and prioritize upgrading to version 2.2.2 or later. This includes operators, platform administrators, and security teams responsible for managing Kubernetes clusters. They should verify exposure and prioritize upgrading to GPUStack version 2.2.2 or later.

Why it matters

CVE-2026-103002 is a high-severity vulnerability in GPUStack that allows an authenticated non-administrator to access sensitive resources, create or modify workloads, or delete resources in a targeted Kubernetes cluster. Defenders should prioritize verifying exposure and upgrading to version 2.2.2 or later.

• Read sensitive resources in the targeted Kubernetes cluster
• Create or modify workloads in the targeted Kubernetes cluster
• Delete resources in the targeted Kubernetes cluster
• Verify exposure and upgrade to GPUStack version 2.2.2 or later

Technical summary

GPUStack, an open-source GPU cluster manager, has a vulnerability in versions 2.2.0-2.2.1. An authenticated non-administrator can exploit this vulnerability to access sensitive resources, create or modify workloads, or delete resources in a targeted Kubernetes cluster. The vulnerability is fixed in version 2.2.2. This vulnerability allows an attacker to access sensitive resources, create or modify workloads, or delete resources in a targeted Kubernetes cluster. The vulnerability affects GPUStack versions 2.2.0-2.2.1.

Defensive priority

Defenders should prioritize verifying exposure in their Kubernetes clusters and upgrading to GPUStack version 2.2.2 or later.

Recommended defensive actions

• Verify exposure in Kubernetes clusters using GPUStack
• Upgrade to GPUStack version 2.2.2 or later
• Monitor for suspicious activity in Kubernetes clusters
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability affects GPUStack versions 2.2.0-2.2.1. The CVE record was published on 2026-11-04T22:17:44.783Z and has not been modified since then. The NVD entry provides additional information on the vulnerability, including its CVSS score and affected versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.