Threats tagged 'ghsa-gj9m-f8ph-pmhr'

GPUStack versions prior to 2.2.0 contain an authentication bypass vulnerability where requests perceived as originating from the loopback interface are automatically granted administrator privileges without credentials. This occurs because the software trusts the network source IP, which can be spoofed via a same-host reverse proxy or a forged X-GPUStack-Real-IP header. Exploitation allows unauthenticated attackers to gain full administrative access, including user and configuration modification, API key minting, and code execution on worker hosts. The vulnerability is fixed in version 2.2.0 by removing implicit loopback trust and hardening client IP handling.