1 line
2.6 KiB
JSON
1 line
2.6 KiB
JSON
{"schema_version":"1.9.2","id":"GHSA-3hch-x692-6qj3","published":"2026-11-10T15:57:20Z","modified":"2026-11-10T16:15:05.052369873Z","aliases":["CVE-2026-103002"],"summary":"GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover","details":"### Impact\n\nAn authenticated non-administrative user could access a Kubernetes cluster they are not authorized to access through GPUStack's Kubernetes API proxy.\n\nThe `cluster_apiserver_proxy` handler did not perform a resource-level authorization check before forwarding requests to the selected cluster. Requests were forwarded through a worker using its Kubernetes ServiceAccount credentials.\n\nDepending on the permissions granted to that ServiceAccount, an attacker could read sensitive Kubernetes resources, create or modify workloads, or delete resources and disrupt services. Creating attacker-controlled workloads could result in code execution in the target cluster.\n\nExploitation requires a Kubernetes-provider cluster with a reachable worker. The operations available to the attacker are limited by the worker's ServiceAccount permissions.\n\n### Patches\n\nFixed in `gpustack` `v2.2.2`.\n\n### Workarounds\n\nRestrict access to the GPUStack instance to trusted administrator accounts until upgrading.","affected":[{"package":{"name":"gpustack","ecosystem":"PyPI","purl":"pkg:pypi/gpustack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.2"}]}],"versions":["2.2.0","2.2.1","2.2.1rc1","2.2.2rc1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-3hch-x692-6qj3/GHSA-3hch-x692-6qj3.json"}}],"references":[{"type":"WEB","url":"https://github.com/gpustack/gpustack/security/advisories/GHSA-3hch-x692-6qj3"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103002"},{"type":"WEB","url":"https://github.com/gpustack/gpustack/pull/5911"},{"type":"WEB","url":"https://github.com/gpustack/gpustack/pull/5936"},{"type":"WEB","url":"https://github.com/gpustack/gpustack/commit/363191fa1da7e1426c6041f78b3cf00aff2622fe"},{"type":"WEB","url":"https://github.com/gpustack/gpustack/commit/cdd67467e0f314609dc82216e142940d321abfed"},{"type":"PACKAGE","url":"https://github.com/gpustack/gpustack"},{"type":"WEB","url":"https://github.com/gpustack/gpustack/releases/tag/v2.2.2"}],"database_specific":{"cwe_ids":["CWE-639","CWE-862"],"github_reviewed":true,"github_reviewed_at":"2026-11-10T15:57:20Z","nvd_published_at":"2026-11-04T22:17:44Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]} |