Threats affecting pkg:pypi/gpustack

CVE-2026-58658 is a high-severity vulnerability in GPUStack versions up to 2.2.1 that allows unauthenticated attackers to access sensitive inference logs and modify worker configuration. The flaw arises from missing authentication on the /serveLogs and /debug endpoints, enabling attackers to enumerate model instance IDs, stream logs containing prompts and completions, change log levels, and read memory profiling data. This vulnerability was fixed in a commit identified as 4e20551.