Update: added to CISA KEV. GPUStack, an open-source GPU cluster manager for AI model serving, has an authentication bypass that lets an attacker gain full administrator access remotely, without logging in, by making a request appear to come from the local machine. This allows them to change users and models, create persistent admin API keys, steal worker and cloud-provider credentials, and run code on worker hosts, and t...