Is CVE-2026-58658 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-58658 being exploited in the wild.

How severe is CVE-2026-58658?

High severity, with a CVSS score of 8.2, published 15 July 2026.

Is there a fix for CVE-2026-58658?

A patch was published on 2026-07-15: Fix committed in version 2.2.2 (commit 4e20551) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-58658 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-58658?

Check whether you run GPUStack at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-58658: GPUStack unauthenticated information disclosure in worker endpoints

CVE-2026-58658 · Severity: high · CVSS 8.2 · Published 2026-07-15

GPUStack, a platform for managing GPU clusters for AI model serving, contains a security flaw where worker nodes expose sensitive data without requiring a password. An attacker can remotely access private AI chat logs, including user prompts and model responses, and modify system settings like logging levels. This could lead to the exposure of proprietary information or sensitive customer data processed by the AI models.

Technologies: GPUStack. Vendors: GPUStack.

Quick answers

Is CVE-2026-58658 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-58658 being exploited in the wild.
How severe is CVE-2026-58658?: High severity, with a CVSS score of 8.2, published 15 July 2026.
Which products and versions are affected?: GPUStack through 2.2.1.
Is there a fix for CVE-2026-58658?: A patch was published on 2026-07-15: Fix committed in version 2.2.2 (commit 4e20551) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58658 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-58658?: Check whether you run GPUStack at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

GPUStack worker nodes fail to enforce authentication on the /serveLogs and /debug endpoints (typically on port 10150). The root cause is a missing authentication dependency in the FastAPI router configuration within gpustack/worker/worker.py. An unauthenticated remote attacker can enumerate model instance IDs to stream serving logs containing plaintext prompts and completions. Additionally, attackers can read memory profiling data and modify the worker's log level via PUT requests to the /debug/log_level endpoint. The vulnerability is addressed in commit 4e20551 by applying the worker_request_auth dependency to the affected routers.

Affected products

GPUStack GPUStack through 2.2.1

Timeline

2026-06-09: disclosed: Vulnerability reported to vendor via email
2026-07-10: other: Public issue tracker entry created
2026-07-15: advisory: NVD and VulnCheck advisories published
2026-07-15: patched: Fix committed in version 2.2.2 (commit 4e20551)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.