{"apiVersion":"1","notice":"Security Threat Pulse API v1. Free, no key. Facts with sources; verdicts follow the published rules at https://securitythreatpulse.com/methodology. Not advice. Some source data is withheld here until its terms allow re-serving.","generatedAt":"2026-11-11T08:30:31.702Z","products":["gpustack"],"actNowTotal":1,"results":[{"query":"gpustack","matched":1,"actNow":1,"events":[{"id":"kev-2026-11-09-gpustack-gpustack","url":"https://securitythreatpulse.com/events/kev-2026-11-09-gpustack-gpustack","title":"GPUStack: attackers can run their own code","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 6 days old, so many systems are likely still unpatched. The severity score is critical (9.8).","tier":"now","rankScore":5,"rankWhy":["Exploitation is confirmed by an authoritative source.","The confirmation is 2 days old."],"rulesVersion":"v3","ladder":{"talk":"confirmed","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-102895"],"vendor":"GPUStack","product":"GPUStack","affectedProducts":[{"kind":"direct","slug":"gpustack/gpustack","vendor":"GPUStack","product":"GPUStack","evidence":["kev","cpe"],"vendorKey":"gpustack","productKey":"gpustack"}],"category":{"id":"other","label":"Other software","why":"Software we have not put in a category yet. Your IT team or provider will know whether you run it.","doThis":"Find out if you use it. If you do, apply the vendor's fix."},"summary":"GPUStack contains an improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml.","cvss":9.8,"epss":0.00555,"exploitMaturity":"none","kevListed":true,"kevDateAdded":"2026-11-09","kevDueDate":"2026-11-12","firstSeenAt":"2026-11-09T00:00:00.000Z","updatedAt":"2026-11-11T00:00:06.173Z","newestEvidenceAt":"2026-11-10T23:35:57.418Z"}]}]}