Evidence · DiggingBeagle record
GPUStack loopback identity trust authentication bypass
GPUStack advisory on trusting loopback and forwarded IP values.
- Published
- Jul 31, 2026
- Source role
- primary disclosure
Evidence record
GPUStack advisory on trusting loopback and forwarded IP values.
Claim-level citations (2)
- supportsGPUStack treated untrusted loopback identity as administrator access: The GPUStack advisory reports that reverse-proxy loopback peer identification or the X-GPUStack-Real-IP header can make an unauthenticated request appear administrator-authorized.
Advisory Summary and reproduction
- supportsGPUStack treated untrusted loopback identity as administrator access: The advisory lists affected releases below 2.2.0 and patched 2.2.0.
Affected and patched versions