[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXS-C_jouNmn1XBvPT_QECE4vXqsHo0-CR4RtgDcvMnY":3,"g5a-risk:CVE-2026-102895":145},{"success":4,"data":5,"meta":142},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":33,"epssPercentile":27,"epssTimeSeries":34,"severity":37,"affectedProducts":38,"affectedProductsCount":43,"references":44,"referencesCount":68,"weaknesses":69,"weaknessesCount":88,"isActivelyExploited":4,"cisaInfo":89,"otxData":27,"relatedBlogPosts":90,"seoMetadata":91,"configurations":116,"relatedVendorCves":126,"notableEvents":127},"CVE-2026-102895","What is CVE-2026-102895?","GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack\u002Fapi\u002Fauth.py treated a loopback request source as the built-in administrator when force_auth_localhost was false, which was the default. A remote request could appear to originate from 127.0.0.1 because client_ip_getter accepted a same-host reverse proxy peer or a client-supplied X-GPUStack-Real-IP loopback value. The bypass allowed unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST \u002Fv2\u002Finference-backends\u002Ffrom-yaml. Exploitation was observed in the wild against a 2.1.1 deployment. This issue is fixed in version 2.2.0.","GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack\u002Fapi\u002Fauth.py t...","2026-11-04T22:17:44.613","2026-11-10T05:17:40.97",9.8,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"CVSSMetricV31":15,"CVSSMetricV30":30,"CVSSMetricV2":31,"CVSSMetricV40":32},[16],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":28,"ImpactScore":29},"security-advisories@github.com","Secondary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":23,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":25,"IntegrityImpact":25,"AvailabilityImpact":25,"BaseScore":12,"BaseSeverity":26,"ExploitCodeMaturity":27,"RemediationLevel":27,"ReportConfidence":27,"TemporalScore":27,"TemporalSeverity":27,"ConfidentialityRequirement":27,"IntegrityRequirement":27,"AvailabilityRequirement":27,"ModifiedAttackVector":27,"ModifiedAttackComplexity":27,"ModifiedPrivilegesRequired":27,"ModifiedUserInteraction":27,"ModifiedScope":27,"ModifiedConfidentialityImpact":27,"ModifiedIntegrityImpact":27,"ModifiedAvailabilityImpact":27,"EnvironmentalScore":27,"EnvironmentalSeverity":27},"3.1","NETWORK","LOW","NONE","UNCHANGED","HIGH","CRITICAL",null,3.9,5.9,[],[],[],0.00517,[35,35,35,36,36,33,33],0.00331,0.00555,"Critical",[39],{"vendor":40,"product":40,"version":41,"criteria":42,"vulnerable":4},"gpustack","*","cpe:2.3:a:gpustack:gpustack:*:*:*:*:*:*:*:*",1,[45,50,54,58,63],{"url":46,"source":47,"tags":48},"https:\u002F\u002Fgithub.com\u002Fgpustack\u002Fgpustack\u002Fcommit\u002F53f42a6a553542974396d16a4ff6b12bcbedb48d","GitHub",[49],"Patch",{"url":51,"source":47,"tags":52},"https:\u002F\u002Fgithub.com\u002Fgpustack\u002Fgpustack\u002Fpull\u002F5346",[53,49],"Issue Tracking",{"url":55,"source":47,"tags":56},"https:\u002F\u002Fgithub.com\u002Fgpustack\u002Fgpustack\u002Freleases\u002Ftag\u002Fv2.2.0",[57],"Release Notes",{"url":59,"source":47,"tags":60},"https:\u002F\u002Fgithub.com\u002Fgpustack\u002Fgpustack\u002Fsecurity\u002Fadvisories\u002FGHSA-gj9m-f8ph-pmhr",[61,62],"Mitigation","Vendor Advisory",{"url":64,"source":65,"tags":66},"https:\u002F\u002Fwww.cisa.gov\u002Fknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102895","CISA",[67],"US Government Resource",5,[70,78,84],{"id":71,"name":72,"description":73,"extendedDescription":74,"status":75,"abstraction":76,"structure":77},"CWE-287","Improper Authentication","When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.","","Draft","Class","Simple",{"id":79,"name":80,"description":81,"extendedDescription":74,"status":82,"abstraction":83,"structure":77},"CWE-290","Authentication Bypass by Spoofing","This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.","Incomplete","Base",{"id":85,"name":86,"description":87,"extendedDescription":74,"status":75,"abstraction":76,"structure":77},"CWE-346","Origin Validation Error","The product does not properly verify that the source of data or communication is valid.",3,{"shortDescription":74,"requiredAction":74,"vulnerabilityName":74,"dateAdded":27},[],{"title":92,"metaDescription":93,"keywords":94,"canonicalUrl":95,"structuredData":96},"What is CVE-2026-102895? Vulnerability Analysis | Security Advisory | EdgeProtect","Comprehensive analysis of CVE-2026-102895, a critical severity cyber security vulnerability from 2026. GPUStack is an open-source GPU cluster manager for AI ...","CVE-2026-102895, CVE-2026-102895 vulnerability, CVE-2026-102895 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2026, CVSS score, exploit, patch, remediation, gpustack security, gpustack vulnerability","\u002Fwhat-is\u002Fcve-2026-102895",{"@context":97,"@type":98,"headline":92,"description":93,"datePublished":10,"dateModified":11,"author":99,"publisher":103,"about":107,"mainEntityOfPage":111,"articleSection":114,"keywords":115},"https:\u002F\u002Fschema.org","TechArticle",{"@type":100,"name":101,"url":102},"Organization","EdgeProtect","https:\u002F\u002Fedgeprotect.io",{"@type":100,"name":101,"url":102,"logo":104},{"@type":105,"url":106},"ImageObject","https:\u002F\u002Fedgeprotect.io\u002Fimg\u002Flogos\u002Fedgeprotect-logo-512.png",{"@type":108,"name":6,"description":109,"additionalType":110},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":112,"@id":113},"WebPage","https:\u002F\u002Fedgeprotect.io\u002Fwhat-is\u002Fcve-2026-102895","Cybersecurity","CVE-2026-102895, CVE-2026-102895 vulnerability, CVE-2026-102895 security, critical severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[117],{"Operator":27,"Negate":27,"Nodes":118},[119],{"Operator":120,"Negate":121,"CPEMatch":122},"OR",false,[123],{"Vulnerable":4,"Criteria":42,"MatchCriteriaID":124,"VersionStartExcluding":27,"VersionStartIncluding":27,"VersionEndExcluding":125,"VersionEndIncluding":27},"3439BFF0-7E02-4EFF-B772-F42FFB05A582","2.2.0",[],[128,135],{"id":129,"eventType":130,"eventTime":131,"details":132,"label":133,"color":134},"71bcd573-e447-4572-a987-73810362e64c","NEW_NVD","2026-11-05T04:01:57.673086+00:00","New CVE added to NVD","Published to NVD","blue",{"id":136,"eventType":137,"eventTime":138,"details":139,"label":140,"color":141},"e82c7e37-10d6-40f7-b9e7-e83017ce9af4","NEW_CISA","2026-11-10T04:01:11.978867+00:00","CVE added to CISA Known Exploited Vulnerabilities","Added to CISA KEV","red",{"lastModified":11,"cacheTime":143,"version":144},1794632481102,"2.0",{"score":146,"band":37,"action":147,"scoredAt":148},90,"Emergency patch","2026-11-13T07:27:08.086624+00:00"]