CISA added an actively exploited vulnerability to its Known Exploited Vulnerabilities catalog on 2026-11-09. The entry, CVE-2026-102895, concerns an improper authentication flaw in GPUStack. The flaw could let an unauthenticated attacker gain administrative access, modify users and models, create persistent administrator API-key, expose worker and cloud-provider secrets, and execute code via POST /v2/inference-backends/from-yaml. CISA’s notice directs users to apply mitigations in accordance with vendor instructions and to follow CISA’s BOD 26-04 prioritizing security. 1