An affected GPUStack inference gateway trusted source IP and proxy headers rather than a user-bound authentication proof. Entry and authority. GPUStack runs behind a proxy or exposes a path in which an attacker-controlled request appears from loopback or carries a trusted IP header. Observed mechanism and consequence. The server accepted a spoofed…
Inspect the ClaimsCase · DiggingBeagle record
GPUStack treated untrusted loopback identity as administrator access
An affected GPUStack inference gateway trusted source IP and proxy headers rather than a user-bound authentication proof.
Public disclosure: Jul 31, 2026
Scope
GPUStack runs behind a proxy or exposes a path in which an attacker-controlled request appears from loopback or carries a trusted IP header. The server accepted a spoofed administrative source identity for management API operations independent of actual end-user credentials.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
Scoped Claim(s) link to SRC-2026-DB233-GPUSTACK-LOOPBACK; reviewed as vulnerability in research_demonstration. Only reported controlled behavior or proof-of-concept is established; no production victim or impact magnitude is measured.
Assessed Nov 10, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-DB233-GPUSTACK-LOOPBACK-01 · CLM-DB233-GPUSTACK-LOOPBACK-02 · GPUStack loopback identity trust authentication bypass
At a glance
The advisory predates this Radar checkpoint. A separately asserted CISA KEV addition or exploitation status was not verified through the blocked CISA portal and is not presented as confirmed.
Limits and uncertaintyFull account
An affected GPUStack inference gateway trusted source IP and proxy headers rather than a user-bound authentication proof.
Entry and authority. GPUStack runs behind a proxy or exposes a path in which an attacker-controlled request appears from loopback or carries a trusted IP header.
Observed mechanism and consequence. The server accepted a spoofed administrative source identity for management API operations independent of actual end-user credentials.
Limits and status. The advisory predates this Radar checkpoint. A separately asserted CISA KEV addition or exploitation status was not verified through the blocked CISA portal and is not presented as confirmed.
GPUStack treated requests arriving through a loopback-looking path, including reverse-proxy peer addresses or a trusted-header shortcut, as local administrator requests. In a deployment where external traffic can acquire that identity, the administrator-only management path may be reachable without the expected user authentication. The report demonstrates an authorization shortcut, not that any particular cloud provider's GPU server was compromised.
Mechanism and trust boundary
- 01
Precondition and trust context
GPUStack runs behind a proxy or exposes a path in which an attacker-controlled request appears from loopback or carries a trusted IP header.
- 02
Crossed boundary
The server accepted a spoofed administrative source identity for management API operations independent of actual end-user credentials.
- 03
Observed limit
The advisory predates this Radar checkpoint. A separately asserted CISA KEV addition or exploitation status was not verified through the blocked CISA portal and is not presented as confirmed.
Timeline
- Jul 31, 2026Event type unspecified
Initial documented finding
GPUStack treated untrusted loopback identity as administrator access
- Jul 31, 2026disclosure
Public disclosure
Claims & evidence
CLM-DB233-GPUSTACK-LOOPBACK-01The GPUStack advisory reports that reverse-proxy loopback peer identification or the X-GPUStack-Real-IP header can make an unauthenticated request appear administrator-authorized.supported
Basis: reported finding
- supportsGPUStack loopback identity trust authentication bypassprimary disclosure
Advisory Summary and reproduction
CLM-DB233-GPUSTACK-LOOPBACK-02The advisory lists affected releases below 2.2.0 and patched 2.2.0.supported
Basis: reported finding
- supportsGPUStack loopback identity trust authentication bypassprimary disclosure
Affected and patched versions
Controls and mitigations
- Remove loopback identity exemptions for privileged APIs or bind their use to an authenticated local transport; apply the upstream security fix.
- Strip and reissue real-IP headers at a trusted edge, and test requests traversing the exact production proxy path.
Unknowns and contradictions
- The advisory predates this Radar checkpoint. A separately asserted CISA KEV addition or exploitation status was not verified through the blocked CISA portal and is not presented as confirmed.
Sources and citation
Material revision history
- Nov 11, 2026 · Published version · first publication · revision 235