{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-103002", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-29T20:46:08.335Z", "datePublished": "2026-11-04T21:33:41.176Z", "dateUpdated": "2026-11-06T11:34:03.826Z"}, "containers": {"cna": {"title": "GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/gpustack/gpustack/security/advisories/GHSA-3hch-x692-6qj3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gpustack/gpustack/security/advisories/GHSA-3hch-x692-6qj3"}, {"name": "https://github.com/gpustack/gpustack/pull/5911", "tags": ["x_refsource_MISC"], "url": "https://github.com/gpustack/gpustack/pull/5911"}, {"name": "https://github.com/gpustack/gpustack/pull/5936", "tags": ["x_refsource_MISC"], "url": "https://github.com/gpustack/gpustack/pull/5936"}, {"name": "https://github.com/gpustack/gpustack/commit/363191fa1da7e1426c6041f78b3cf00aff2622fe", "tags": ["x_refsource_MISC"], "url": "https://github.com/gpustack/gpustack/commit/363191fa1da7e1426c6041f78b3cf00aff2622fe"}, {"name": "https://github.com/gpustack/gpustack/commit/cdd67467e0f314609dc82216e142940d321abfed", "tags": ["x_refsource_MISC"], "url": "https://github.com/gpustack/gpustack/commit/cdd67467e0f314609dc82216e142940d321abfed"}, {"name": "https://github.com/gpustack/gpustack/releases/tag/v2.2.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/gpustack/gpustack/releases/tag/v2.2.2"}], "affected": [{"vendor": "gpustack", "product": "gpustack", "versions": [{"version": ">= 2.2.0, < 2.2.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-04T21:33:41.176Z"}, "descriptions": [{"lang": "en", "value": "GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, cluster_apiserver_proxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster without a resource-level authorization check. The proxy used a reachable worker's Kubernetes ServiceAccount credentials, so the caller could read sensitive resources, create or modify workloads, or delete resources according to that ServiceAccount's permissions. Exploitation required a Kubernetes-provider cluster with a reachable worker, and attacker-controlled workloads could result in code execution in the target cluster. This issue is fixed in version 2.2.2."}], "source": {"advisory": "GHSA-3hch-x692-6qj3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-06T04:56:43.686904Z", "id": "CVE-2026-103002", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T11:34:03.826Z"}}]}}

{}

{"affected": [{"affectedData": [{"product": "gpustack", "vendor": "gpustack", "versions": [{"status": "affected", "version": ">= 2.2.0, < 2.2.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, cluster_apiserver_proxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster without a resource-level authorization check. The proxy used a reachable worker's Kubernetes ServiceAccount credentials, so the caller could read sensitive resources, create or modify workloads, or delete resources according to that ServiceAccount's permissions. Exploitation required a Kubernetes-provider cluster with a reachable worker, and attacker-controlled workloads could result in code execution in the target cluster. This issue is fixed in version 2.2.2."}], "id": "CVE-2026-103002", "lastModified": "2026-11-06T12:17:15.310", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-103002", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T04:56:43.686904Z", "version": "2.0.3"}}]}, "published": "2026-11-04T22:17:44.783", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/gpustack/gpustack/commit/363191fa1da7e1426c6041f78b3cf00aff2622fe"}, {"source": "security-advisories@github.com", "url": "https://github.com/gpustack/gpustack/commit/cdd67467e0f314609dc82216e142940d321abfed"}, {"source": "security-advisories@github.com", "url": "https://github.com/gpustack/gpustack/pull/5911"}, {"source": "security-advisories@github.com", "url": "https://github.com/gpustack/gpustack/pull/5936"}, {"source": "security-advisories@github.com", "url": "https://github.com/gpustack/gpustack/releases/tag/v2.2.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/gpustack/gpustack/security/advisories/GHSA-3hch-x692-6qj3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}, {"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "gpustack: GPUStack: Arbitrary code execution via missing authorization in cluster API server proxy", "id": "2567503", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567503"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-425", "details": ["GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, cluster_apiserver_proxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster without a resource-level authorization check. The proxy used a reachable worker's Kubernetes ServiceAccount credentials, so the caller could read sensitive resources, create or modify workloads, or delete resources according to that ServiceAccount's permissions. Exploitation required a Kubernetes-provider cluster with a reachable worker, and attacker-controlled workloads could result in code execution in the target cluster. This issue is fixed in version 2.2.2.", "A flaw was found in GPUStack. An authenticated remote user without administrator privileges can forward requests through the cluster API server proxy to a connected Kubernetes cluster without proper resource-level authorization checks. Because the proxy executes requests using the credentials of a worker node service account, an attacker can read sensitive resources, manipulate workloads, and potentially achieve arbitrary code execution within the target cluster."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-103002", "public_date": "2026-11-04T21:33:41Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-103002\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-103002\nhttps://github.com/gpustack/gpustack/commit/363191fa1da7e1426c6041f78b3cf00aff2622fe\nhttps://github.com/gpustack/gpustack/commit/cdd67467e0f314609dc82216e142940d321abfed\nhttps://github.com/gpustack/gpustack/pull/5911\nhttps://github.com/gpustack/gpustack/pull/5936\nhttps://github.com/gpustack/gpustack/releases/tag/v2.2.2\nhttps://github.com/gpustack/gpustack/security/advisories/GHSA-3hch-x692-6qj3"], "statement": "This vulnerability is rated as Important rather than Critical because exploitation requires valid user authentication and a reachable worker node, though successful attacks permit complete cluster workload manipulation and code execution. GPUStack is not included or supported in Red Hat Enterprise Linux or Red Hat OpenShift, limiting direct exposure on default platform deployments. In environments where third-party GPUStack instances manage or proxy requests to Red Hat OpenShift clusters, the lack of resource authorization enables non-administrative users to abuse worker ServiceAccount privileges.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.2.0,2.2.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "gpustack", "source": "cna", "vendor": "gpustack"}, "product": "gpustack", "vendor": "gpustack"}], "created": "2026-11-04T22:30:13.764249+00:00", "updated": "2026-11-06T14:00:07.364364+00:00", "vendors": ["gpustack", "gpustack$PRODUCT$gpustack"]}