CyberRota Analysis
AI-GeneratedThe vulnerability allows unauthenticated attackers to access sensitive inference logs and modify worker configurations through unprotected /serveLogs and /debug endpoints in GPUStack versions up to 2.2.1. This can lead to unauthorized access to sensitive data, including prompts and completions, as well as the ability to manipulate logging settings and read memory profiling information. Organizations using GPUStack should prioritize patching to mitigate the risk of data exposure and potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GPUStack through 2.2.1, fixed in commit 4e20551, contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to access sensitive inference logs and modify worker configuration by exploiting unprotected /serveLogs and /debug endpoints on the worker port. Attackers can enumerate model instance IDs to stream serving logs containing prompts and completions, change log levels, and read memory profiling data without any authentication.