gpustack
PyPI3 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting gpustackpage 1 of 1
- CVE-2026-102894CRITICALCVSS 9.1EG 9.1fixed in 2.2.22026-11-04
vulnerable: 0.7.1 ... 2.2.2rc1 (26 versions)
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 0.7.1 until 2.2.2, the /auth/saml/callback endpoint decoded SAML XML, used its NameID and attributes to resolve or provision a user, an…
- CVE-2026-102895CRITICALCVSS 9.8EG 9.8⚠ KEVfixed in 2.2.02026-11-04
vulnerable: 0.0.0 ... 2.2.0rc4 (57 versions)
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py treated a loopback request source as the built-in administrator when force_auth_loc…
- CVE-2026-103002HIGHCVSS 8.8EG 8.8fixed in 2.2.22026-11-04
vulnerable: 2.2.0, 2.2.1, 2.2.1rc1, 2.2.2rc1
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, cluster_apiserver_proxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster wit…
Check whether gpustack is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for gpustack CVEs against the assets you own.
Book a Demo →