Auth bypass in Gpustack
CVE-2026-58658
GPUStack through 2.2.1, fixed in commit 4e20551, contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to access sensitive inference logs and modify worker configuration by exploiting unprotected /serveLogs and /debug endpoints on the worker port. Attackers can enumerate model instance IDs to stream serving logs containing prompts and completions, change log levels, and read memory profiling data without any authentication.
Vulnerability class: Broken Authentication
EPSS: 0.005 (42.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N.
Affected products
- Gpustack — versions 0, 4e20551b5aaf76f93a8769d32b7fef999e22a4d3
Weakness classification (CWE)
References
- disclosure@vulncheck.com (technical-description, exploit)
- disclosure@vulncheck.com (patch)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-58658?
- CVE-2026-58658 is a high-severity vulnerability in Gpustack, classified under Missing Authentication for Critical Function. CVSS score: 8.2/10. Published 2026-07-15.
- How severe is CVE-2026-58658?
- High severity. CVSS v3 base score is 8.2 out of 10.