KNOWN EXPLOITED VULNERABILITY DOSSIER
CVE-2026-102895
GPUStack · GPUStack
GPUStack contains an improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml.
Correlated Federal Court Cases & Exploitation Context (0)
No federal court indictment in the current archive directly cites CVE-2026-102895. This record tracks its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog on 2026-11-09.
Associated Government Advisories
Tracked under CISA Known Exploited Vulnerabilities Binding Operational Directive 22-01 for federal civilian agency remediation.