GPUStack authentication bypass exploited in the wild

CVE-2026-102895, an authentication bypass in GPUStack GPU cluster management software, is being actively exploited. The vulnerability allows attackers to spoof the X-Gpustack-Real-IP header to bypass authentication by spoofing loopback addresses. Affected versions are prior to 2.2.0 released June 2026. GPUStack administrators should upgrade immediately to patch systems managing AI workloads.