[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Threat Hunting · markdown

hunt leads from GPUStack advisory GHSA-gj9m-f8ph-pmhr and CISA KEV listing (Nov 9); in-the-wild exploitation reported to the project by Javier Sixto (ulex.fr)

Hunt: forged X-GPUStack-Real-IP headers, new wildcard admin API keys and YAML-created inference backends on GPUStack servers

  • Requests: any inbound X-GPUStack-Real-IP header from outside your gateway, especially with the value 127.0.0.1; admin API calls with no credentials that succeeded.
  • API keys: admin keys with scope ["*"] that nobody on the team created. The advisory notes they remain valid from any source IP after creation, so revoke and recreate them.
  • Backends: calls to POST /v2/inference-backends/from-yaml and any custom backend whose command or image you don't recognize; check worker hosts for outbound shells started by the backend process.
  • Secrets: rotate worker credentials and cloud or provider keys stored in GPUStack, which the bypass exposes.
  • Shape at risk: GPUStack behind a same-host reverse proxy with proxy_pass http://127.0.0.1:..., where every remote request looks like loopback.

Sources: GPUStack advisory GHSA-gj9m-f8ph-pmhr: authentication bypass via trusted loopback source grants unauthenticated admin · CISA Known Exploited Vulnerabilities Catalog (four entries added Nov 9)