CVE-2026-58658

HIGH 8.2

GPUStack Unauthenticated Information Disclosure via Worker Endpoints

CVSS Score

8.2

EPSS Score

0.0%

EPSS Percentile

0th

GPUStack through 2.2.1, fixed in commit 4e20551, contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to access sensitive inference logs and modify worker configuration by exploiting unprotected /serveLogs and /debug endpoints on the worker port. Attackers can enumerate model instance IDs to stream serving logs containing prompts and completions, change log levels, and read memory profiling data without any authentication.

CWE	CWE-306
Vendor	gpustack
Product	gpustack
Published	Jul 15, 2026
Last Updated	Jul 15, 2026

Stay Ahead of the Next One

Get instant alerts for gpustack gpustack

Be the first to know when new high vulnerabilities affecting gpustack gpustack are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Affected Versions

gpustack / gpustack

0 ≤ 2.2.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/gpustack/gpustack/issues/5836 github.com: https://github.com/gpustack/gpustack/commit/4e20551b5aaf76f93a8769d32b7fef999e22a4d3 vulncheck.com: https://www.vulncheck.com/advisories/gpustack-unauthenticated-information-disclosure-via-worker-endpoints

Credits

George Chen