GitHub Advisory Databaseabout 3 hours ago

GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin

Impact In GPUStack before v2.2.0, get_current_user (in gpustack/api/auth.py) promotes any request whose source is considered loopback to the built-in administrator account when force_auth_localhost is False (the default). The "source" is derived by client_ip_getter, which can be

Published November 9, 2026 · 10:15 PM
Impact In GPUStack before v2.2.0, get_current_user (in gpustack/api/auth.py) promotes any request whose source is considered loopback to the built-in administrator account when force_auth_localhost is False (the default). The "source" is derived by client_ip_getter, which can be
Read

Source: GitHub Advisory Database

Ask AI about this articleBeta

The AI only has access to this article — it won't make up facts. Try:

AI can be wrong. Cross-check before sharing.

Supporting evidence0 items
Community check0 comments
No votes yet
0% real0% fake