Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
gpustack/gpustack
main @ 0e3f05f
27
Fixes
0
CVEs
HIGH
Peak severity
25.0%
Coverage
Highlights
Auth Bypass: 16 prior fixes. Scrutinize any change in this area.
gpustack/api/auth.py: most-fixed (6 issues). Treat as high-risk during review.
17 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Insecure authentication checks such as trusting unverified client IP headers, auto-authenticating localhost, and failing to validate deactivated user accounts created widespread authorization bypass vectors.
Auth Bypass: Bypassing the standard UserService update pattern allowed direct database updates to leave cached user permissions active, preventing revoked or updated user access states from propagating immediately.
Privilege Escalation: Lack of strict schema validation on self-update endpoints allowed regular users to bind privileged administrator parameters to their session profiles.