Scanners exploit GPUStack auth bypass flaw
Attackers are actively probing GPUStack installations with a spoofed header that bypasses authentication entirely in versions before 2.2.0.
Sourceisc.sans.edu — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-102895 as exploited in the wild.
SANS ISC reports active exploitation attempts against CVE-2026-102895, a trivial authentication-bypass vulnerability in GPUStack, open-source software used to manage GPU clusters for AI workloads. The flaw affects all versions prior to 2.2.0 (released end of June) and stems from GPUStack trusting a custom header, "X-Gpustack-Real-IP", which is meant to convey the originating client IP similar to X-Forwarded-For. If an attacker sets this header to 127.0.0.1 (loopback), GPUStack treats the request as originating from a trusted local source and bypasses authentication and access controls.
The vulnerability was disclosed publicly at the end of July but only received a CVE assignment on November 4th, leaving a gap during which defenders may not have tracked it via CVE feeds. SANS ISC observed straightforward exploitation attempts — simple GET requests with the spoofed header — originating from IP 144.91.73.103. This same source has also been scanning for other AI-related endpoints (/v1/models, /v1beta/models, /v1/messages, /models), suggesting broader reconnaissance against AI infrastructure rather than GPUStack alone.
Defenders running GPUStack should upgrade to 2.2.0 or later immediately. Given GPUStack typically manages GPU resources for AI workloads, a successful bypass could grant an attacker control over AI infrastructure, model access, or compute resources. Organizations should review logs for the X-Gpustack-Real-IP header and inbound traffic from the identified scanning IP.
Mentioned in this report
Detection guidance
Probing of AI Inference API Model-Listing Endpoints on Web Server
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects requests to AI/LLM API discovery endpoints (/v1/models, /v1beta/models, /v1/messages, /models) as seen in scanning against GPUStack and similar AI infrastructure. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Probing of AI Inference API Model-Listing Endpoints on Web Server
description: Detects GET or POST requests to AI/LLM API discovery endpoints such as
/v1/models, /v1beta/models and /v1/messages, as seen in reconnaissance for GPUStack
and other AI infrastructure around CVE-2026-102895. The same source hitting several
of these paths in a short period is the strongest signal, so aggregate by c-ip in
the SIEM. Legitimate API clients also call these paths, so review the source before
acting.
tags:
- attack.reconnaissance
- attack.t1595
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_path:
cs-uri-stem|endswith:
- /v1/models
- /v1beta/models
- /v1/messages
selection_exact:
cs-uri-stem: /models
selection_method:
cs-method:
- GET
- POST
condition: 1 of selection_path or selection_exact and selection_method
falsepositives:
- Legitimate LLM client applications and SDKs that enumerate models on a self-hosted
inference gateway
- Internal monitoring or health checks that poll the model list endpoint
level: low
id: 8907c86a-b931-50df-8126-3975d9c05287
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33514
1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, and Suricata. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://isc.sans.edu/diary/rss/33514
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs