Advisories for Pypi/Gpustack package

The callback Base64-decodes the posted XML, reads NameID and attributes, resolves or provisions the user, and mints a gpustack_session JWT — but never calls OneLogin_Saml2_Auth.process_response(), the step that verifies the signature, issuer, audience, destination, and time conditions. No credentials are required, and SAML SSO does not even need to be configured. The callback processes the payload and issues a session regardless of whether SAML is set up, so every deployment …

An authenticated non-administrative user could access a Kubernetes cluster they are not authorized to access through GPUStack's Kubernetes API proxy. The cluster_apiserver_proxy handler did not perform a resource-level authorization check before forwarding requests to the selected cluster. Requests were forwarded through a worker using its Kubernetes ServiceAccount credentials. Depending on the permissions granted to that ServiceAccount, an attacker could read sensitive Kubernetes resources, create or modify workloads, or delete resources …

In GPUStack before v2.2.0, get_current_user (in gpustack/api/auth.py) promotes any request whose source is considered loopback to the built-in administrator account when force_auth_localhost is False (the default). The "source" is derived by client_ip_getter, which can be made to report 127.0.0.1 without any credentials in two ways: Same-host reverse proxy (TCP peer). In the canonical self-hosted shape — GPUStack behind a same-host reverse proxy with proxy_pass http://127.0.0.1:<port> — every remote request arrives …