GPUStack SAML callback auth bypass — unverified SAMLResponse enables account takeover (CVE-2026-102894)
Severity: critical · Patch status: patched · Since 2026-11-10 · CVE-2026-102894
GPUStack's SAML callback endpoint Base64-decodes the posted SAMLResponse, extracts NameID and attributes, resolves or provisions the user, and mints a gpustacksession JWT without ever calling OneLoginSaml2Auth.processresponse(), skipping signature, issuer, audience, destination and time-condition validation. Anyone with network reachability to /auth/saml/callback can authenticate as any existing user (full admin account takeover) or have a new non-admin user provisioned; SAML SSO need not be configured, so every deployment on affected versions is exposed. Response/Assertion IDs are never consumed, allowing indefinite replay of captured signed responses. Reported privately by UC Berkeley researchers and an anonymous researcher. Fixed in gpustack 2.2.2, which validates responses via processresponse() and gates SAML/OIDC routes to the active provider. No configuration workaround exists; block access to the callback until upgrading.
What to do
- Upgrade gpustack to 2.2.2 immediately
- Until upgraded, block network access to /auth/saml/callback at a reverse proxy or ingress
- Audit logs for sessions issued via the SAML callback and for unexpected user provisioning; rotate/invalidate suspicious sessions
- Restrict exposure of GPUStack instances to trusted networks
Fixed versions
Sources
All live incidents on Threat Watch
