---
title: Hunt: forged X-GPUStack-Real-IP headers, new wildcard admin API keys and YAML-created inference backends on GPUStack servers | ctxsec
url: https://ctxsec.com/items/hunt-gpustack-loopback-admin-bypass-backdoored-inference-backends
description: "GPUStack's advisory says the observed attack minted administrator access and then created custom inference backends that ran reverse shells on worker hosts. Those leave traces in the request log and in GPUStack's own configuration, even on servers that have since been patched."
status: "hunt leads from GPUStack advisory GHSA-gj9m-f8ph-pmhr and CISA KEV listing (Nov 9); in-the-wild exploitation reported to the project by Javier Sixto (ulex.fr)"
published: 2026-11-09
---

> GPUStack's advisory says the observed attack minted administrator access and then created custom inference backends that ran reverse shells on worker hosts. Those leave traces in the request log and in GPUStack's own configuration, even on servers that have since been patched.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-gpustack-loopback-admin-bypass-backdoored-inference-backends.md)

hunt leads from GPUStack advisory GHSA-gj9m-f8ph-pmhr and CISA KEV listing (Nov 9); in-the-wild exploitation reported to the project by Javier Sixto (ulex.fr)

2026-11-09

### Hunt: forged X-GPUStack-Real-IP headers, new wildcard admin API keys and YAML-created inference backends on GPUStack servers

- **Requests:** any inbound `X-GPUStack-Real-IP` header from outside your gateway, especially with the value `127.0.0.1`; admin API calls with no credentials that succeeded.
- **API keys:** admin keys with scope `["*"]` that nobody on the team created. The advisory notes they remain valid from any source IP after creation, so revoke and recreate them.
- **Backends:** calls to `POST /v2/inference-backends/from-yaml` and any custom backend whose command or image you don't recognize; check worker hosts for outbound shells started by the backend process.
- **Secrets:** rotate worker credentials and cloud or provider keys stored in GPUStack, which the bypass exposes.
- **Shape at risk:** GPUStack behind a same-host reverse proxy with `proxy_pass http://127.0.0.1:...`, where every remote request looks like loopback.

Sources: [GPUStack advisory GHSA-gj9m-f8ph-pmhr: authentication bypass via trusted loopback source grants unauthenticated admin](https://github.com/gpustack/gpustack/security/advisories/GHSA-gj9m-f8ph-pmhr) · [CISA Known Exploited Vulnerabilities Catalog (four entries added Nov 9)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)