CISA adds GPUStack auth bypass to KEV catalog

GPUStack contains an improper authentication vulnerability allowing unauthenticated administrative access, including persistent API key creation and code execution via POST /v2/inference-backends/from-yaml. CISA added CVE-2026-102895 to its Known Exploited Vulnerabilities catalog with a federal patch deadline of November 12, 2026. Organizations running GPUStack should immediately apply patches or remove the service from internet exposure.