GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover
Not on CISA's list of exploited flaws, and not in the news we track.
0.26%
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-102894. Nothing runs until you send it.
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 0.7.1 until 2.2.2, the /auth/saml/callback endpoint decoded SAML XML, used its NameID and attributes to resolve or provision a user, and minted a gpustack_session JWT without calling OneLogin_Saml2_Auth.process_response to verify the signature, issuer, audience, destination, or time conditions. Any network client could submit an identity for an existing user, including an administrator, or provision a new non-administrator account, even when SAML was not configured. Response and Assertion identifiers were not consumed, so captured signed responses could also be replayed. This issue is fixed in version 2.2.2.