{"id":"CVE-2026-102894","published":"2026-11-04T22:17:44.440","lastModified":"2026-11-04T22:17:44.440","description":"GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 0.7.1 until 2.2.2, the /auth/saml/callback endpoint decoded SAML XML, used its NameID and attributes to resolve or provision a user, and minted a gpustack_session JWT without calling OneLogin_Saml2_Auth.process_response to verify the signature, issuer, audience, destination, or time conditions. Any network client could submit an identity for an existing user, including an administrator, or provision a new non-administrator account, even when SAML was not configured. Response and Assertion identifiers were not consumed, so captured signed responses could also be replayed. This issue is fixed in version 2.2.2.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-294","CWE-347"],"vendors":[],"products":[],"references":[{"url":"https://github.com/gpustack/gpustack/commit/705edbe1b5feec63959306daecd640e1c70eced2","tags":[]},{"url":"https://github.com/gpustack/gpustack/commit/adc6d82be34e48390720a1361df616e2ea9d6d45","tags":[]},{"url":"https://github.com/gpustack/gpustack/pull/5753","tags":[]},{"url":"https://github.com/gpustack/gpustack/pull/5923","tags":[]},{"url":"https://github.com/gpustack/gpustack/releases/tag/v2.2.2","tags":[]},{"url":"https://github.com/gpustack/gpustack/security/advisories/GHSA-62m9-f875-rqw6","tags":[]}],"exploitRefs":[{"url":"https://github.com/gpustack/gpustack/commit/705edbe1b5feec63959306daecd640e1c70eced2","tags":[]},{"url":"https://github.com/gpustack/gpustack/commit/adc6d82be34e48390720a1361df616e2ea9d6d45","tags":[]},{"url":"https://github.com/gpustack/gpustack/pull/5753","tags":[]},{"url":"https://github.com/gpustack/gpustack/pull/5923","tags":[]},{"url":"https://github.com/gpustack/gpustack/releases/tag/v2.2.2","tags":[]},{"url":"https://github.com/gpustack/gpustack/security/advisories/GHSA-62m9-f875-rqw6","tags":[]}],"hasPoc":true,"ai":{"summary":"The /auth/saml/callback endpoint in GPUStack (versions 0.7.1–2.2.2) accepted unverified SAML responses, allowing any attacker to forge authentication tokens for existing users—including administrators—or create new accounts—by submitting arbitrary SAML XML without signature, issuer, audience, or time validation.","exploitability":"Exploitation is trivial for any network-accessible attacker with no authentication required and no SAML configuration needed on the target.","blast_radius":"An attacker can impersonate any user—including admins—leading to full account takeover, privilege escalation, and potential compromise of the entire GPU cluster management system.","remediation":"Upgrade to GPUStack version 2.2.2 or later, which properly invokes OneLogin_Saml2_Auth.process_response to validate SAML assertions before minting session tokens.","detection":"Look for POST requests to /auth/saml/callback containing SAMLResponse parameters with malformed, missing, or unverifiable signatures in web server or application logs; repeated or identical SAMLResponse values from different source IPs may indicate replay attempts.","tags":["saml-bypass","auth-bypass","jwt-impersonation","replay","web"],"model":"garnet-coder","analyzedAt":"2026-11-05T09:48:37.739Z"}}