What happened
In GPUStack from 0.7.1 to 2.2.2, the /auth/saml/callback endpoint decoded SAML XML, used its NameID/attributes to resolve or provision a user, and minted a gpustack_session JWT without calling OneLogin_Saml2_Auth.process_response to verify the signature, issuer, audience, destination, or time conditions. Any network client could submit an identity for an existing user, including an administrator, or provision a new non-admin account — even when SAML was not configured. Response/assertion identifiers were not consumed, so captured signed responses could also be replayed.
Why it matters
This is a second, distinct critical break in the same AI-infrastructure control plane: an unauthenticated remote actor can forge a login as an administrator of a GPU cluster manager for AI serving, without any prior credentials and independent of whether SAML is enabled. NVD/CISA rate it CVSS 9.1 (Critical), automatable with total technical impact; it is fixed only in 2.2.2 (separate from the CVE-2026-102895 loopback bypass fixed in 2.2.0).
Attack vector
Unauthenticated remote request to the SAML callback endpoint carrying a forged or replayed (non-verified) identity, minting an admin session JWT.
Affected systems
GPUStack 0.7.1 – 2.2.1 (CVE-2026-102894, CWE-294/CWE-347), fixed in 2.2.2
Mitigation
Upgrade to GPUStack 2.2.2+, which verifies the SAML response; even if SAML is not used, upgrade/disable the callback and restrict reachability of the endpoint.