Changes.Watch~ upgrade verdicts ~
Free digest
Securitysshole: password bypass in Alpine’s OpenSSH

critical vulnerability

GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin

Exploited · CISA KEVFix availableCritical · CVSS 9.8EPSS 0.33%

Published Nov 9, 2026 · updated Nov 9, 2026 · added to CISA KEV Nov 9, 2026

What to do

  1. Upgrade to a fixed version: gpustack 2.2.0.
  2. This is exploited in the wild: treat it as urgent (CISA's federal deadline is Nov 12, 2026).
  3. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIgpustack503 downloads/week

Vulnerable versions
< 2.2.0
Fixed in
2.2.0

Check your project: pip show gpustack

What changed

  1. Nov 9, 2026

    Published in the GitHub Advisory Database as critical.

  2. Nov 9, 2026

    Added to CISA KEV on 2026-11-09: exploitation in the wild confirmed; federal remediation due 2026-11-12.

Sources

CWE-287 Improper Authentication · CWE-290 Authentication Bypass by Spoofing · CWE-346 Origin Validation Error

← All critical vulnerabilities