What happened
On 9 November 2026 CISA added CVE-2026-102895 (GPUStack, an open-source GPU cluster manager for serving AI models) to its Known Exploited Vulnerabilities catalog, with a federal remediation due date of 12 November 2026 and a forensic-triage flag under BOD 26-04. On 10 November 2026 the Cloud Security Alliance AI Safety Initiative published a research note analyzing the flaw and its implications for AI infrastructure. The CVSS 9.8 vulnerability lets any request appearing to originate from loopback (via a same-host reverse proxy or a forged X-GPUStack-Real-IP header) be treated as the built-in administrator; an attacker can mint API keys, read worker/cloud credentials, and register a malicious inference backend to get code execution on GPU workers - used in the wild to launch reverse shells. The note advises upgrading to at least 2.2.0 (preferably 2.2.2, which also fixes CVE-2026-102894) and treating any exposed pre-2.2.0 instance as compromised because patching does not evict attacker-created users/keys or clean compromised hosts; it also highlights the underlying design pattern of deriving identity from network position.
Why it matters
AI model-serving control planes (GPUStack, Ray, LiteLLM) are converging on the CISA KEV list as prime targets. A control-plane compromise hands an attacker every GPU worker, its credentials, and the inference backend. The note gives concrete, time-critical guidance for private AI inference operators and generalizes a security design flaw (network position as identity) that applies widely to AI platform auth.
Action needed
Immediately patch GPUStack to >=2.2.2, rotate all worker and cloud-provider credentials on any exposed pre-2.2.0 instance and treat it as compromised, and review any AI platform that derives identity from network position/loopback, especially when fronted by a same-host reverse proxy.