PT-2026-60247 · Git+1 · Gpustack

George Chen · CVE-2026-58658 · Published 2026-07-15 · Updated 2026-07-15

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions GPUStack versions prior to 2.2.1

Description An unauthenticated information disclosure issue allows attackers to access sensitive inference logs and modify worker configuration. This is achieved by exploiting the unprotected '/serveLogs' and '/debug' endpoints on the worker port. Attackers can enumerate model instance IDs to stream serving logs containing prompts and completions, change log levels, and read memory profiling data without authentication.

Recommendations Update to the version containing commit 4e20551. Restrict access to the '/serveLogs' and '/debug' endpoints to minimize the risk of exploitation.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-58658

Affected Products

Gpustack

References · 7

• 🔥 https://github.com/gpustack/gpustack/issues/5836 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58658.json · Exploit
• https://github.com/gpustack/gpustack/commit/4e20551b5aaf76f93a8769d32b7fef999e22a4d3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-58658 · Security Note
• https://osv.dev/vulnerability/CVE-2026-58658 · Vendor Advisory
• https://github.com/gpustack/gpustack · Note
• https://vulncheck.com/advisories/gpustack-unauthenticated-information-disclosure-via-worker-endpoints · Note