Changes.Watch~ upgrade verdicts ~
Free digest
Securitysshole: password bypass in Alpine’s OpenSSH

critical vulnerability

GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover

Fix availableCritical · CVSS 9.1EPSS 0.26%

Published Nov 10, 2026 · updated Nov 10, 2026

What to do

  1. Upgrade to a fixed version: gpustack 2.2.2.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIgpustack615 downloads/week

Vulnerable versions
>= 0.7.1, < 2.2.2
Fixed in
2.2.2

Check your project: pip show gpustack

What changed

  1. Nov 10, 2026

    Published in the GitHub Advisory Database as critical.

Sources

CWE-294 Authentication Bypass by Capture-replay · CWE-347 Improper Verification of Cryptographic Signature

← All critical vulnerabilities