ThinkFacility Sign in
  1. Home
  2. Security
  3. Python package (gpustack)
CriticalActively exploitedPython package (gpustack)

GPUStack before 2.2.2: a login bypass attackers are exploiting gives them admin, update now

Anyone running a GPUStack server to host AI models on their own GPUs, especially behind a reverse proxy or open to the internet.

How to fix it

You haveUpdate to
< 2.2.2→2.2.2

Check your version

Which version you have
pip show gpustack

Update

pip
pip install --upgrade "gpustack>=2.2.2"
uv
uv add "gpustack>=2.2.2"

If you can't update yet

Set force_auth_localhost=true so local requests need a login too, and have your proxy strip any X-GPUStack-Real-IP header. GPUStack says turning SAML off doesn't help, so block /auth/saml/callback at the proxy until you update.

Attackers are using the worst of the three: before 2.2.0, a request that looks like it came from the machine itself, through a reverse proxy or a forged X-GPUStack-Real-IP header, gets admin access with no login. Version 2.2.2 also fixes a SAML login bypass and endpoints that let one user take over the cluster.

Sources