What is CVE-2026-58658?

CVE-2026-58658 is a high-severity vulnerability in Gpustack, classified under Missing Authentication for Critical Function. CVSS score: 8.2/10. Published 2026-07-15.

How severe is CVE-2026-58658?

High severity. CVSS v3 base score is 8.2 out of 10.

Auth bypass in Gpustack

CVE-2026-58658

GPUStack through 2.2.1, fixed in commit 4e20551, contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to access sensitive inference logs and modify worker configuration by exploiting unprot…

Vulnerability class: Broken Authentication

CVSS v3 metric

CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N.

Affected products

Gpustack — versions 0, 4e20551b5aaf76f93a8769d32b7fef999e22a4d3

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

disclosure@vulncheck.com (technical-description, exploit)
disclosure@vulncheck.com (patch)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-58658?: CVE-2026-58658 is a high-severity vulnerability in Gpustack, classified under Missing Authentication for Critical Function. CVSS score: 8.2/10. Published 2026-07-15.
How severe is CVE-2026-58658?: High severity. CVSS v3 base score is 8.2 out of 10.