GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover

Impact

An authenticated non-administrative user could access a Kubernetes cluster they are not authorized to access through GPUStack's Kubernetes API proxy.

The cluster_apiserver_proxy handler did not perform a resource-level authorization check before forwarding requests to the selected cluster. Requests were forwarded through a worker using its Kubernetes ServiceAccount credentials.

Depending on the permissions granted to that ServiceAccount, an attacker could read sensitive Kubernetes resources, create or modify workloads, or delete resources and disrupt services. Creating attacker-controlled workloads could result in code execution in the target cluster.

Exploitation requires a Kubernetes-provider cluster with a reachable worker. The operations available to the attacker are limited by the worker's ServiceAccount permissions.

Patches

Fixed in gpustack v2.2.2.

Workarounds

Restrict access to the GPUStack instance to trusted administrator accounts until upgrading.