# Scanners exploit GPUStack auth bypass flaw

Published: 2026-11-12 · Severity: high · Sectors: Technology
Canonical: https://vorant.io/reports/bb7655e2-35bd-5f0b-8005-1a492323df76/scanners-exploit-gpustack-auth-bypass-flaw
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> Attackers are actively probing GPUStack installations with a spoofed header that bypasses authentication entirely in versions before 2.2.0.

Source: isc.sans.edu — https://isc.sans.edu/diary/rss/33514

## What to check

- Applies to: The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: CISA lists CVE-2026-102895 as exploited in the wild.

SANS ISC reports active exploitation attempts against CVE-2026-102895, a trivial authentication-bypass vulnerability in GPUStack, open-source software used to manage GPU clusters for AI workloads. The flaw affects all versions prior to 2.2.0 (released end of June) and stems from GPUStack trusting a custom header, "X-Gpustack-Real-IP", which is meant to convey the originating client IP similar to X-Forwarded-For. If an attacker sets this header to 127.0.0.1 (loopback), GPUStack treats the request as originating from a trusted local source and bypasses authentication and access controls.

The vulnerability was disclosed publicly at the end of July but only received a CVE assignment on November 4th, leaving a gap during which defenders may not have tracked it via CVE feeds. SANS ISC observed straightforward exploitation attempts — simple GET requests with the spoofed header — originating from IP 144.91.73.103. This same source has also been scanning for other AI-related endpoints (/v1/models, /v1beta/models, /v1/messages, /models), suggesting broader reconnaissance against AI infrastructure rather than GPUStack alone.

Defenders running GPUStack should upgrade to 2.2.0 or later immediately. Given GPUStack typically manages GPU resources for AI workloads, a successful bypass could grant an attacker control over AI infrastructure, model access, or compute resources. Organizations should review logs for the X-Gpustack-Real-IP header and inbound traffic from the identified scanning IP.

## Mentioned in this report

- Vulnerabilities: CVE-2026-102895 (KEV)

## Detection guidance (public sample)

### Probing of AI Inference API Model-Listing Endpoints on Web Server

ATT&CK: T1595

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs webserver logs. Status: experimental. Generated from the report; not run against telemetry.

Detects requests to AI/LLM API discovery endpoints (/v1/models, /v1beta/models, /v1/messages, /models) as seen in scanning against GPUStack and similar AI infrastructure. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Probing of AI Inference API Model-Listing Endpoints on Web Server
description: Detects GET or POST requests to AI/LLM API discovery endpoints such as
  /v1/models, /v1beta/models and /v1/messages, as seen in reconnaissance for GPUStack
  and other AI infrastructure around CVE-2026-102895. The same source hitting several
  of these paths in a short period is the strongest signal, so aggregate by c-ip in
  the SIEM. Legitimate API clients also call these paths, so review the source before
  acting.
tags:
- attack.reconnaissance
- attack.t1595
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|endswith:
    - /v1/models
    - /v1beta/models
    - /v1/messages
  selection_exact:
    cs-uri-stem: /models
  selection_method:
    cs-method:
    - GET
    - POST
  condition: 1 of selection_path or selection_exact and selection_method
falsepositives:
- Legitimate LLM client applications and SDKs that enumerate models on a self-hosted
  inference gateway
- Internal monitoring or health checks that poll the model list endpoint
level: low
id: 8907c86a-b931-50df-8126-3975d9c05287
status: experimental
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33514
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: an indicator rule with Sigma, Splunk SPL, Elastic, and Suricata. A free account opens it.

Source reporting: https://isc.sans.edu/diary/rss/33514

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/bb7655e2-35bd-5f0b-8005-1a492323df76/scanners-exploit-gpustack-auth-bypass-flaw.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup