[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEp_IDqV2q4ECKgigPgq90FBlQy-5julqXN4DjfSiN_Q":3},{"article":4,"iocs":46,"watch_terms":59,"solutions":60,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"621e4244-9557-479a-a2e3-9517011ee9d6","Exploit Attempts for GPUStack Authentication Bypass (CVE-2026-102895), (Thu, Nov 12th)","exploit-attempts-for-gpustack-authentication-bypass-cve-2026-102895-thu-nov-12th-f92924","CVE-2026-102895 is a trivial authentication-bypass vulnerability. GPUStack is also an attractive target. It is open-source software that manages clusters of GPUs, which are typically used to run AI workloads. All versions of GPUStack prior to 2.2.0, which was released at the end of June. This vulnerability was not made public until the end of July, and the CVE was assigned on November 4th.","Exploit attempts for CVE-2026-102895, a trivial authentication bypass vulnerability in GPUStack, have been observed. The vulnerability allows attackers to spoof the 'X-Gpustack-Real-IP' header to bypass authentication. GPUStack version 2.2.0 and later, released in June, addresses this issue. The observed exploit attempts originate from IP address 144.91.73.103.","Exploit attempts targeting GPUStack authentication bypass vulnerability CVE-2026-102895 observed.","https:\u002F\u002Fisc.sans.edu\u002Fdiary\u002Frss\u002F33514","https:\u002F\u002Fisc.sans.edu\u002Fdiaryimages\u002Fimages\u002FScreenshot%202026-11-12%20at%206_49_09%E2%80%AFAM.png","2026-11-12T11:56:24+00:00","2026-11-12T12:00:28.326183+00:00",8,[17,20],{"name":18,"type":19},"GPUStack","product",{"name":21,"type":22},"AI workloads","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":23,"icon":25,"name":26,"slug":27},null,"Vulnerabilities","vulnerabilities",[29,34,36,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",[47,51,55],{"type":48,"value":49,"context":50},"cve","CVE-2026-102895","GPUStack authentication bypass vulnerability",{"type":52,"value":53,"context":54},"ip","144.91.73.103","IP address observed originating exploit attempts",{"type":56,"value":57,"context":58},"url","https:\u002F\u002Fgithub.com\u002Fgpustack\u002Fgpustack\u002Fsecurity\u002Fadvisories\u002FGHSA-gj9m-f8ph-pmhr","Security advisory for the vulnerability",[18],{"controls":61,"vendors":145},[62,91,116],{"slug":63,"name":64,"problem":65,"products":66},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":92,"name":93,"problem":94,"products":95},"patch-management","Automated patch management","Known holes get closed in days, not months.",[96,104,109],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":105,"product_name":106,"url":107,"description":108},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":92,"product_name":113,"url":114,"description":115},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":117,"name":118,"problem":119,"products":120},"firewall","Next-generation firewall and intrusion prevention","Malicious traffic is blocked at the network edge and between zones.",[121,129,137],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","next-generation-firewall","Next-Generation Firewalls","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fnetwork-security\u002Fnext-generation-firewall","Hardware, virtual and cloud firewalls running PAN-OS, with intrusion prevention.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","secure-firewall","Cisco Secure Firewall","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Ffirewalls\u002Findex.html","Next-generation firewalls with intrusion prevention, using Talos threat intelligence.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"clavister","Clavister","\u002Fvendor-logos\u002Fclavister.png","clavister-netwall","Clavister NetWall","https:\u002F\u002Fwww.clavister.com\u002Fproducts\u002Fclavister-netwall\u002F","Next-generation firewalls developed in Sweden.",[],{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":156},"gpustack-authentication-bypass-exploited-in-the-wild-patch-now","GPUStack Authentication Bypass Exploited in the Wild — Patch Now","CVE-2026-102895 is a trivial authentication bypass in GPUStack that allows attackers to spoof the 'X-Gpustack-Real-IP' HTTP header and completely circumvent authentication controls. This class of vulnerability — trusting a client-supplied header for access decisions — represents a fundamental flaw in authentication logic and is straightforward to exploit, requiring little sophistication. A fix was available in GPUStack version 2.2.0 since June, yet active exploit attempts are now being observed, meaning organizations running unpatched instances are exposed to fully automated attacks. This incident underscores that for internet-facing services, the gap between patch availability and patch deployment is a directly exploitable window of risk.",[151,152,153,154,155],"CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 IA-3: Device Identification and Authentication","OWASP A07:2021 Identification and Authentication Failures","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":157,"NIST SP 800-53 SI-2: Flaw Remediation":158,"CIS Control 7: Continuous Vulnerability Management (v8)":159,"OWASP A07:2021 Identification and Authentication Failures":160,"NIST SP 800-53 IA-3: Device Identification and Authentication":161},"NIS2 Article 21(2)(e) requires security in acquisition, development, and maintenance including vulnerability handling; organizations operating GPUStack are obligated to track and apply security patches promptly to address known vulnerabilities like this one.","SI-2 requires organizations to identify, report, and correct information system flaws in a timely manner; timely application of the GPUStack 2.2.0 patch would have closed this authentication bypass before active exploitation.","CIS Control 7 requires organizations to continuously assess and remediate vulnerabilities; had a patching process been in place for internet-facing services, the June fix for CVE-2026-102895 would have been applied before exploit attempts began.","This OWASP category covers flaws where authentication mechanisms can be bypassed; trusting a spoofable HTTP header to make access control decisions is a direct instance of an authentication failure.","IA-3 requires that systems authenticate devices without relying on untrusted, user-controlled identifiers; accepting the client-supplied 'X-Gpustack-Real-IP' header as a basis for authentication violates this principle."]