{"id":"CVE-2026-103002","aliases":["EUVD-2026-117177","GHSA-3hch-x692-6qj3"],"status":"published","title":"GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover","description":"GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, cluster_apiserver_proxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster without a resource-level authorization check. The proxy used a reachable worker's Kubernetes ServiceAccount credentials, so the caller could read sensitive resources, create or modify workloads, or delete resources according to that ServiceAccount's permissions. Exploitation required a Kubernetes-provider cluster with a reachable worker, and attacker-controlled workloads could result in code execution in the target cluster. This issue is fixed in version 2.2.2.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-14","score":0.0036,"percentile":0.30291,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-639","CWE-862"],"published":"2026-11-04T21:33:41.176Z","modified":"2026-11-10T16:15:05Z","fixes":[{"ecosystem":"PyPI","package":"gpustack","fixed_in":["2.2.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"gpustack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"gpustack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.2"}]}],"versions":["2.2.0","2.2.1","2.2.1rc1","2.2.2rc1"]}],"products":[{"vendor":"gpustack","product":"gpustack"}],"references":[{"url":"https://github.com/gpustack/gpustack/security/advisories/GHSA-3hch-x692-6qj3","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/gpustack/gpustack/pull/5911","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/gpustack/gpustack/pull/5936","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/gpustack/gpustack/commit/363191fa1da7e1426c6041f78b3cf00aff2622fe","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/gpustack/gpustack/commit/cdd67467e0f314609dc82216e142940d321abfed","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/gpustack/gpustack/releases/tag/v2.2.2","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103002","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3hch-x692-6qj3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103002.json","tags":["advisory"]},{"url":"https://github.com/gpustack/gpustack","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-103002","title":"GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover","description":"GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, cluster_apiserver_proxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster without a resource-level authorization check. The proxy used a reachable worker's Kubernetes ServiceAccount credentials, so the caller could read sensitive resources, create or modify workloads, or delete resources according to that ServiceAccount's permissions. Exploitation required a Kubernetes-provider cluster with a reachable worker, and attacker-controlled workloads could result in code execution in the target cluster. This issue is fixed in version 2.2.2.","status":"published","published":"2026-11-04T21:33:41.176Z","modified":"2026-11-06T11:34:03.826Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-639","CWE-862"],"updated_at":"2026-11-06T12:28:03.779112Z"}],"euvd":[{"id":"EUVD-2026-117177","description":"GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover","status":"published","published":"2026-11-10T15:57:20Z","modified":"2026-11-10T15:57:20Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-10T17:21:44.229469Z"}],"ghsa":[{"id":"GHSA-3hch-x692-6qj3","title":"GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover","description":"### Impact\n\nAn authenticated non-administrative user could access a Kubernetes cluster they are not authorized to access through GPUStack's Kubernetes API proxy.\n\nThe `cluster_apiserver_proxy` handler did not perform a resource-level authorization check before forwarding requests to the selected cluster. Requests were forwarded through a worker using its Kubernetes ServiceAccount credentials.\n\nDepending on the permissions granted to that ServiceAccount, an attacker could read sensitive Kubernetes resources, create or modify workloads, or delete resources and disrupt services. Creating attacker-controlled workloads could result in code execution in the target cluster.\n\nExploitation requires a Kubernetes-provider cluster with a reachable worker. The operations available to the attacker are limited by the worker's ServiceAccount permissions.\n\n### Patches\n\nFixed in `gpustack` `v2.2.2`.\n\n### Workarounds\n\nRestrict access to the GPUStack instance to trusted administrator accounts until upgrading.","status":"published","published":"2026-11-10T15:57:20Z","modified":"2026-11-10T15:57:22Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-639","CWE-862"],"updated_at":"2026-11-10T16:25:10.795148Z"}],"nvd":[{"id":"CVE-2026-103002","description":"GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, cluster_apiserver_proxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster without a resource-level authorization check. The proxy used a reachable worker's Kubernetes ServiceAccount credentials, so the caller could read sensitive resources, create or modify workloads, or delete resources according to that ServiceAccount's permissions. Exploitation required a Kubernetes-provider cluster with a reachable worker, and attacker-controlled workloads could result in code execution in the target cluster. This issue is fixed in version 2.2.2.","status":"published","published":"2026-11-04T22:17:44.783Z","modified":"2026-11-12T22:18:51.47Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-639","CWE-862"],"updated_at":"2026-11-12T23:33:07.118138Z"}],"osv":[{"id":"CVE-2026-103002","title":"GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover","description":"GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, cluster_apiserver_proxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster without a resource-level authorization check. The proxy used a reachable worker's Kubernetes ServiceAccount credentials, so the caller could read sensitive resources, create or modify workloads, or delete resources according to that ServiceAccount's permissions. Exploitation required a Kubernetes-provider cluster with a reachable worker, and attacker-controlled workloads could result in code execution in the target cluster. This issue is fixed in version 2.2.2.","status":"published","published":"2026-11-04T21:33:41.176Z","modified":"2026-11-14T02:30:55.967622196Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-639","CWE-862"],"updated_at":"2026-11-07T03:07:59.573031Z"},{"id":"GHSA-3hch-x692-6qj3","title":"GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover","description":"### Impact\n\nAn authenticated non-administrative user could access a Kubernetes cluster they are not authorized to access through GPUStack's Kubernetes API proxy.\n\nThe `cluster_apiserver_proxy` handler did not perform a resource-level authorization check before forwarding requests to the selected cluster. Requests were forwarded through a worker using its Kubernetes ServiceAccount credentials.\n\nDepending on the permissions granted to that ServiceAccount, an attacker could read sensitive Kubernetes resources, create or modify workloads, or delete resources and disrupt services. Creating attacker-controlled workloads could result in code execution in the target cluster.\n\nExploitation requires a Kubernetes-provider cluster with a reachable worker. The operations available to the attacker are limited by the worker's ServiceAccount permissions.\n\n### Patches\n\nFixed in `gpustack` `v2.2.2`.\n\n### Workarounds\n\nRestrict access to the GPUStack instance to trusted administrator accounts until upgrading.","status":"published","published":"2026-11-10T15:57:20Z","modified":"2026-11-10T16:15:05.052369873Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-639","CWE-862"],"updated_at":"2026-11-10T16:33:20.11523Z"}]}}