Which versions of GPUStack are affected by CVE-2026-58658?

GPUStack versions through 2.2.1 contain an unauthenticated remote access vulnerability (CVE-2026-58658) in worker-port endpoints that exposes live AI inference logs containing user prompts, model…. A patch is available.

Is there a public PoC exploit available for CVE-2026-58658?

Yes, a public proof-of-concept exploit is available for CVE-2026-58658. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-58658?

Within 24 hours, inventory all GPUStack deployments and identify systems running version 2.2.1 or earlier, noting which have worker ports reachable from untrusted networks or the internet. Within 7 days, apply the vendor-released patch that adds authentication controls to the /serveLogs and /debug endpoints per vendor advisory (fix deployed in commit 4e20551). Within 30 days, implement network segmentation to restrict worker-port access to authorized internal systems only, audit access logs for signs of exploitation, and verify that all worker-port endpoints enforce authentication.

GPUStack CVE-2026-58658

Q: What is the CVSS score of CVE-2026-58658?

CVE-2026-58658 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-44750 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-15 VulnCheck

GHSA-26wv-hf3j-hjjh

Authentication Bypass Information Disclosure Gpustack

8.8

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Network-reachable worker endpoints with no auth (PR:N) and no interaction give AC:L; high confidentiality from leaked prompts/logs, low integrity from config changes, no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 15, 2026 - 17:45 vuln.today

Analysis Generated

Jul 15, 2026 - 17:45 vuln.today

CVE Published

Jul 15, 2026 - 17:00 cve.org

HIGH 8.8

DescriptionCVE.org

GPUStack through 2.2.1, fixed in commit 4e20551, contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to access sensitive inference logs and modify worker configuration by exploiting unprotected /serveLogs and /debug endpoints on the worker port. Attackers can enumerate model instance IDs to stream serving logs containing prompts and completions, change log levels, and read memory profiling data without any authentication.

AnalysisAI

Unauthenticated information disclosure in GPUStack through version 2.2.1 lets remote attackers reach the worker port's unprotected /serveLogs and /debug endpoints to stream live inference logs - including user prompts and model completions - and to alter worker runtime configuration such as log levels and memory profiling output. Because the flaw is missing authentication (CWE-306) on network-exposed endpoints, exploitation requires no credentials and no user interaction; publicly available exploit code exists, though the issue is not listed in CISA KEV. VulnCheck reported it and the vendor fixed it in commit 4e20551.

Technical ContextAI

GPUStack is an open-source GPU cluster manager used to schedule and serve large language models and other AI inference workloads across worker nodes. Each worker runs a FastAPI application (gpustack/worker/worker.py) that, in the vulnerable versions, mounted the debug router (prefix /debug) and the logs router without any authentication dependency. The root cause is CWE-306 (Missing Authentication for a Critical Function): sensitive operational endpoints were registered on the worker's listening port (default 10150) with no auth guard, so anyone able to reach that port could enumerate model instance IDs, tail the corresponding serving logs, change log verbosity, and read memory profiling data. The single affected package is identified by CPE cpe:2.3:a:gpustack:gpustack:*, and the fix wraps both routers with dependencies=[Depends(worker_request_auth)], now requiring the local worker token (default /var/lib/gpustack/worker_token) or an admin API key.

RemediationAI

Upstream fix available (commit 4e20551); the released patched version number is not independently confirmed from the provided data, so upgrade to a GPUStack build that includes commit 4e20551b5aaf76f93a8769d32b7fef999e22a4d3, which adds worker_request_auth to both the /debug and logs routers. Until you can upgrade, restrict network access to the worker port (default 10150) using firewall rules or security groups so only the GPUStack control plane and trusted operators can reach it - this closes the exposure but will break any tooling that expects direct worker access. Additionally ensure the worker token file (/var/lib/gpustack/worker_token) and admin API keys are protected, since the patched endpoints authenticate against them. Consult the vendor issue (https://github.com/gpustack/gpustack/issues/5836) and VulnCheck advisory (https://www.vulncheck.com/advisories/gpustack-unauthenticated-information-disclosure-via-worker-endpoints) for confirmation of the fixed release.