The flaw resides in the authentication helper that mistakenly treats any loopback traffic as a built‑in administrator when the configuration flag force_auth_localhost is set to its default false value. By sending a request that appears to originate from 127.0.0.1—either through a same‑host reverse‑proxy connection or by injecting a loopback value in the X-GPUStack-Real‑IP header—an attacker can obtain full administrative privileges without authenticating. These privileges allow the attacker to create persistent administrator API keys, modify user accounts and models, expose worker hardware secrets, and execute arbitrary code via the POST /v2/inference-backends/from-yaml endpoint.

This vulnerability affects GPUStack, the open‑source GPU cluster manager, versions earlier than 2.2.0. An observed instance of exploitation targeted a 2.1.1 deployment. The issue is contingent on an environment where the daemon is reachable over a network that can forward loopback‑indicating headers or peer connections, and where the default configuration has not overridden the force_auth_localhost setting.

The CVSS score of 9.8 classifies the flaw as critical, indicating both broad impact and high privileges obtained. Although EPSS data is not available, the vulnerability was seen in the wild, suggesting that exploit development or deployment is feasible. It is not currently listed in the CISA KEV catalogue, but the lack of a KEV listing does not reduce the likelihood of exploitation. Attackers can remotely send crafted requests or manipulate reverse‑proxy behavior to masquerade as localhost, gaining administrative control with no credential requirement.