HighCVECVE-2026-102895
[CVE-2026-102895] GPUStack GPUStack — GPUStack Improper Authentication Vulnerability
CISA KEV·Source published ·1 min read
What happened?
GPUStack contains an improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes).
Key details
- Linux Kernel has a missing variable initialization vulnerability affecting page-cache-backed data.
- The flaw occurs when the shared-fragment marker is not preserved during socket buffer coalescing.
- ESP input processing decrypts shared fragments in place due to the missing initialization.
- This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells.
Affected
- Linux Kernel is affected by this missing initialization vulnerability.
Fixes and mitigations
- Apply mitigations per vendor instructions and CISA BOD 26-04 guidance.
Summarised by SecOraLens from CISA KEV. Always read the original source before acting. How SecOraLens verifies advisories.