Skip to main content
cve.nowby Sazabi
Menu
PyPI

Package

gpustack

3 known CVEs (2 critical, 1 high), with the versions each affects and the releases that fix them.

PyPI

Latest release
2.3.0 (Oct 23, 2026): no advisory affects it
Newest unaffected release
2.3.0 (Oct 23, 2026), the latest release
Advisories
3 · 2 critical, 1 high
Weekly downloads
615
Dependents
0
Releases
70 since 0.0.0 (Nov 27, 2024)
Registry
PyPI
Releases read
Nov 11, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover

    Affected: from 2.2.0, fixed in 2.2.2.

    Fixed in 2.2.2 (released Jul 24, 2026, 103 days before disclosure).

    The latest release, 2.3.0, is not affected.

  • CVE-2026-102894Critical 9.1

    GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover

    Affected: from 0.7.1, fixed in 2.2.2.

    Fixed in 2.2.2 (released Jul 24, 2026, 103 days before disclosure).

    The latest release, 2.3.0, is not affected.

  • CVE-2026-102895Critical 9.8 · KEV

    GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated…

    Affected: fixed in 2.2.0.

    Fixed in 2.2.0 (released Jun 18, 2026, 139 days before disclosure).

    The latest release, 2.3.0, is not affected.