CVE-2026-102894 is a critical-severity (CVSS 9.1) CWE-294 vulnerability in gpustack. A fix is available for gpustack — see the affected versions and patch details below.
GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- A successful exploit gives an attacker total control of the affected component, not partial access.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-102894.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
gpustackReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Impact
The callback Base64-decodes the posted XML, reads NameID and attributes, resolves or provisions the user, and mints a gpustack_session JWT — but never calls OneLogin_Saml2_Auth.process_response(), the step that verifies the signature, issuer, audience, destination, and time conditions.
No credentials are required, and SAML SSO does not even need to be configured. The callback processes the payload and issues a session regardless of whether SAML is set up, so every deployment is affected, not only SAML-enabled ones. Anyone who can reach the endpoint over the network can authenticate as an arbitrary identity by posting a response that names it:
- If the name matches an existing user (e.g. an administrator), the attacker receives that user's session — full account takeover, including administrator access.
- Otherwise, a new non-admin user is provisioned.
Administrator access grants full control over the deployment and the infrastructure it manages. Because Response/Assertion IDs are never consumed, a captured signed response also replays indefinitely.
Precondition: network reachability to /auth/saml/callback. SAML SSO configuration is not required. A full proof-of-concept is available privately to maintainers.
Patches
Fixed in gpustack 2.2.2:
- The SAML callback now validates the response via OneLogin_Saml2_Auth.process_response() — signature, issuer, audience, destination, and time conditions — and rejects responses that fail, so forged or replayed assertions are no longer accepted.
- The SAML and OIDC login/callback routes are now gated to run only when that provider is the configured active provider, so a deployment that has not enabled the provider no longer parses attacker-supplied IdP payloads.
Workarounds
There is no effective configuration-level workaround — disabling or not configuring SAML does not mitigate this on affected versions, since the callback runs regardless. Until upgraded, block network access to /auth/saml/callback (e.g. at a reverse proxy / ingress).
Credit
Reported privately by Austin Chu, Sohee Kim, and Corban Villa (UC Berkeley security research project), and independently, earlier, by a researcher who wishes to remain anonymous.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | gpustack | ≥ 0.7.1&&< 2.2.2 | 2.2.2pip install --upgrade 'gpustack==2.2.2' |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for gpustack, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update gpustack to 2.2.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-102894 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Frequently Asked Questions
Is CVE-2026-102894 in your dependencies?
Find it across PyPI, including transitive dependencies.