CVE-2026-103002

gpustack: GPUStack: Arbitrary code execution via missing authorization in cluster API server proxy

gpustack

### Impact An authenticated non-administrative user could access a Kubernetes cluster they are not authorized to access through GPUStack's Kubernetes API proxy. The `cluster_apiserver_proxy` handler did not perform a resource-level authorization check before forwarding requests to the selected cluster. Requests were forwarded through a worker using its Kubernetes ServiceAccount credentials. Depending on the permissions granted to that ServiceAccount, an attacker could read…

4. Nov 2026

Ausgewertete Quellen

• Red Hat
  Red Hat
• NVD
  CVE-2026-103002
• GitHub
  GHSA-3hch-x692-6qj3