CVE-2026-58658: GPUStack Information Disclosure Flaw

CVE-2026-58658 Overview

CVE-2026-58658 is an unauthenticated information disclosure vulnerability in GPUStack through version 2.2.1. The flaw exposes the /serveLogs and /debug endpoints on the worker port without authentication controls. Attackers can enumerate model instance IDs to stream inference logs containing prompts and completions, alter log levels, and read memory profiling data. The issue is tracked under CWE-306: Missing Authentication for Critical Function and was fixed in commit 4e20551.

Critical Impact
Remote attackers can access sensitive AI inference data including user prompts and model completions without any credentials, and can modify worker configuration on exposed GPUStack deployments.

Affected Products

GPUStack versions through 2.2.1
GPUStack worker component (/serveLogs endpoint)
GPUStack worker component (/debug endpoint)

Discovery Timeline

2026-07-15 - CVE-2026-58658 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-58658

Vulnerability Analysis

GPUStack is an open-source GPU cluster manager used to run large language model (LLM) inference workloads. The worker process exposes an HTTP API that includes routers for debug information, memory profiling, and serving logs. In versions through 2.2.1, the debug.router and logs.router FastAPI routers are mounted without the worker_request_auth dependency that protects the versioned API surface.

An unauthenticated attacker on the network can reach these routes directly on the worker port. By enumerating model instance identifiers, the attacker can stream live serving logs. These logs contain the raw prompts submitted to hosted models and the completions returned to users, exposing potentially sensitive data. The /debug endpoints additionally allow log level changes and disclose memory profiling data useful for further attack planning.

Root Cause

The root cause is missing authentication on FastAPI routers registered in the worker application. While the versioned API router included dependencies=[Depends(worker_request_auth)], the debug and logs routers were registered without any dependency, leaving them publicly reachable.

Attack Vector

Exploitation requires only network access to the GPUStack worker port. No credentials, user interaction, or specialized tooling are needed. The attacker sends HTTP requests to /serveLogs/{instance_id} or /debug/* and reads streamed responses.

python

             prefix=default_versioned_prefix,
             dependencies=[Depends(worker_request_auth)],
         )
-        app.include_router(debug.router, prefix="/debug")
+        app.include_router(
+            debug.router,
+            prefix="/debug",
+            dependencies=[Depends(worker_request_auth)],
+        )
         app.include_router(probes.router)
-        app.include_router(logs.router)
+        app.include_router(
+            logs.router,
+            dependencies=[Depends(worker_request_auth)],
+        )
         app.include_router(proxy.router)
         app.include_router(filesystem.router)
         app.include_router(cluster_proxy.router)

Source: GPUStack security patch commit 4e20551. The patch adds worker_request_auth as a FastAPI dependency to both the debug and logs routers.

Detection Methods for CVE-2026-58658

Indicators of Compromise

Unauthenticated HTTP GET requests to /serveLogs/ paths on GPUStack worker ports.
HTTP requests to /debug/pprof, /debug/log_level, or other /debug/* routes from unexpected source IPs.
Long-lived streaming HTTP connections to worker endpoints from clients outside the management network.
Sequential enumeration patterns targeting model instance identifiers on worker ports.

Detection Strategies

Inspect reverse proxy and application logs for requests to /serveLogs or /debug that lack an authentication token or bearer header.
Correlate access patterns showing enumeration of instance IDs followed by sustained log-stream connections.
Alert on any external network access to worker ports, which should typically be restricted to control plane nodes.

Monitoring Recommendations

Enable HTTP access logging on all GPUStack workers and forward events to a centralized log store.
Baseline normal worker traffic and flag deviations in source IP, request path, or connection duration.
Monitor GPUStack version telemetry to identify instances still running vulnerable releases through 2.2.1.

How to Mitigate CVE-2026-58658

Immediate Actions Required

Upgrade GPUStack to a version that includes commit 4e20551 or later.
Restrict network exposure of GPUStack worker ports to trusted control plane hosts only.
Review recent worker access logs for unauthorized requests to /serveLogs and /debug paths.
Rotate or invalidate any credentials or session tokens that may have appeared in exposed inference prompts.

Patch Information

The vulnerability is fixed in GPUStack commit 4e20551b5aaf76f93a8769d32b7fef999e22a4d3. The fix wraps both the debug and logs routers with the worker_request_auth FastAPI dependency. See the GitHub issue discussion and the VulnCheck advisory for additional context.

Workarounds

Place GPUStack workers behind a network firewall or service mesh that enforces authentication before requests reach the worker port.
Block external access to /serveLogs and /debug routes at a reverse proxy layer until the patch is applied.
Disable verbose serving logs on hosted models to reduce the sensitivity of exposed data.

bash

# Example: restrict worker port with iptables to trusted control plane subnet
iptables -A INPUT -p tcp --dport 10150 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 10150 -j DROP

# Example: block /serveLogs and /debug at an nginx reverse proxy
# location ~ ^/(serveLogs|debug) {
#     deny all;
#     return 403;
# }