CVE-2026-58658: GPUStack Unauthenticated Information Disclosure via Worker Endpoints
Vulnerability summary
CVE-2026-58658 is a high (CVSS 8.8) vulnerability in gpustack. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 45.4% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Timeline
- 15-07-2026PublishedVulnerability first disclosed.
- 08-11-2026Last modifiedVulnerability information updated.
Description
GPUStack through 2.2.1, fixed in commit 4e20551, contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to access sensitive inference logs and modify worker configuration by exploiting unprotected /serveLogs and /debug endpoints on the worker port. Attackers can enumerate model instance IDs to stream serving logs containing prompts and completions, change log levels, and read memory profiling data without any authentication.
CVSS metrics
4 scores · 2 sources · 2 versions- NVDNIST8.8HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
EPSS trend
Probability
0.53%
Chance of exploitation in the next 30 days
Percentile
45%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.53% on 11-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundGpustack
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Gpustack1 product
- gpustack≤ 2.2.1
1 vendor · 1 product