CISA adds four KEVs: GPUStack CVE-2026-102895, SignalWire FreeSwitch CVE-2026-116779, OpenBSD OpenSSH CVE-2026-123158, IBM Aspera Faspex CVE-2026-123218

Key facts

Detection coverage

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5587 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: GPUStack X-GPUStack-Real-IP Loopback Spoof Authentication Bypass (CVE-2026-102895)

Detects HTTP requests carrying an X-GPUStack-Real-IP header set to a loopback address (127.x or ::1). GPUStack before 2.2.0 trusts client_ip_getter for admin identity, so a remote client that spoofs this header is treated as the built-in administrator. Legitimate clients and proxies never send this header with a loopback value, so any hit is a strong exploitation signal for TL-2026-5587 / CISA KEV CVE-2026-102895. Requires the ingress, reverse-proxy or WAF log to record request headers or raw header text.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1078
• Data sources: nginx:access, access_combined, ingress:nginx, CommonSecurityLog, webserver
• Severity: critical
• Confidence: high

Splunk SPL

index=web sourcetype IN ("nginx:access","access_combined","ingress:nginx","aws:elb:accesslogs") ("X-GPUStack-Real-IP" OR "x_gpustack_real_ip" OR "gpustack_real_ip") | rex field=_raw "(?i)x[-_]gpustack[-_]real[-_]ip[^0-9a-f:.]+(?<spoofed_ip>[0-9a-f:.]+)" | where match(spoofed_ip,"^(127[.]|::1$|0:0:0:0:0:0:0:1$)") | stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as uris values(status) as statuses by src, dest, spoofed_ip | convert ctime(first_seen) ctime(last_seen) | table first_seen last_seen src dest spoofed_ip uris statuses count

Microsoft KQL

CommonSecurityLog | where TimeGenerated > ago(24h) | where * has "X-GPUStack-Real-IP" or * has "x_gpustack_real_ip" | extend Spoofed = extract(@"(?i)x[-_]gpustack[-_]real[-_]ip[^0-9a-f:.]+([0-9a-f:.]+)", 1, tostring(pack_all())) | where Spoofed startswith "127." or Spoofed in ("::1", "0:0:0:0:0:0:0:1") | project TimeGenerated, DeviceVendor, SourceIP, DestinationIP, RequestMethod, RequestURL, Spoofed, DeviceAction

Sigma

title: GPUStack Loopback Authentication Bypass via X-GPUStack-Real-IP Header Spoofing (CVE-2026-102895)
id: 7b1c2a54-3d0e-4f6a-9a1b-5c8e1d2f4a01
status: experimental
description: Detects HTTP requests that carry an X-GPUStack-Real-IP header with a loopback value, used to spoof the client source and obtain built-in administrator access on GPUStack before 2.2.0. Requires web or proxy logs that record request headers.
references:
  - https://github.com/gpustack/gpustack/security/advisories/GHSA-gj9m-f8ph-pmhr
  - https://www.cisa.gov/news-events/alerts/2026/11/09/cisa-adds-four-known-exploited-vulnerabilities-catalog
author: Threadlinqs Team
date: 2026-11-09
tags:
  - attack.initial-access
  - attack.t1190
  - attack.t1078
  - cve.2026.102895
logsource:
  category: webserver
detection:
  keywords:
    - 'X-GPUStack-Real-IP: 127.0.0.1'
    - 'X-GPUStack-Real-IP: ::1'
    - 'x_gpustack_real_ip=127.0.0.1'
    - 'x_gpustack_real_ip=::1'
  condition: keywords
falsepositives:
  - Internal security testing or vulnerability scanning against GPUStack
  - Custom in-house proxy that deliberately forwards a loopback value in this header
level: critical

Known false positives:

• Authorized penetration tests or vulnerability scans replaying the CVE-2026-102895 header
• Custom in-house proxy configured to forward a loopback value in X-GPUStack-Real-IP

Tuning notes: Enable request-header logging at the edge (nginx log_format with $http_x_gpustack_real_ip, WAF header capture). Exclude scanner source IPs during authorized tests. Also strip this header at the gateway as per vendor workaround. Extend the index and sourcetype list to match your proxy.

• 🔒 IBM Aspera Faspex 5 Administrative API Writes from Unexpected Principal (CVE-2026-123218) · unlock with TL Creds
• 🔒 GPUStack Process Spawning Reverse Shell on Worker or Server Host (CVE-2026-102895) · unlock with TL Creds
• 🔒 FreeSWITCH Daemon Spawning Shell or Download Tool (CVE-2026-116779) · unlock with TL Creds
• 🔒 GPUStack POST to /v2/inference-backends/from-yaml Admin Endpoint (CVE-2026-102895) · unlock with TL Creds
• 🔒 GPUStack Admin API Key Creation from External Source (CVE-2026-102895) · unlock with TL Creds
• 🔒 Credential File Harvesting from SSH or Interactive Shell on Linux Host · unlock with TL Creds
• 🔒 FreeSWITCH SIP MESSAGE api+ Command Injection (CVE-2026-116779) · unlock with TL Creds
• 🔒 OpenSSH *sshole Password Login to Key-Only Accounts on musl Hosts (CVE-2026-123158) · unlock with TL Creds

Indicators of compromise

As of 2026-11-09, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5587.

Sample indicators (3 of 9)

• Domain: sshhole[.]com
• URL: hxxps://github[.]com/leonjza/sshhole-lab
• URL: hxxps://github[.]com/predkambrij/sshhole-repro

Defanged, TLP:CLEAR. Full set of 9 indicators: unlock with TL Creds.

Technical analysis

CISA's alert references BOD 26-04 for Federal Civilian Executive Branch remediation.

CISA's 2026-11-09 alert adds four CVEs to the Known Exploited Vulnerabilities catalog. The alert itself gives only the vendor, product and weakness class for each; technical detail comes from the vendor advisories and CVE records. NVD records for the first two CVEs give a KEV remediation due date of 2026-11-12, and the OpenSSH record gives the same date.

CVE-2026-102895 (GPUStack, CWE-287/290/346, CVSS 9.8): versions before 2.2.0 treat requests that appear to originate from loopback as the built-in administrator when force_auth_localhost is false (the default). get_current_user in gpustack/api/auth.py relies on client_ip_getter. Two paths exist: a same-host reverse proxy using proxy_pass to 127.0.0.1 makes every remote request arrive from a loopback peer, and a client-supplied X-GPUStack-Real-IP: 127.0.0.1 header spoofs the source. With admin access an attacker can enumerate and modify users, models, workers and configuration, mint persistent admin API keys with scope ["*"] usable from any IP, read worker and cloud-provider secrets, and reach code execution on worker hosts through the admin-only POST /v2/inference-backends/from-yaml endpoint. The GitHub advisory (GHSA-gj9m-f8ph-pmhr, published 2026-07-31) reports exploitation in the wild against a v2.1.1 deployment where attackers created custom inference backends running reverse shells. Fixed in 2.2.0.

CVE-2026-116779 (FreeSWITCH, CWE-77/78/749, CVSS 9.8): before 1.11.3, sofia_presence_handle_sip_i_message() splits the To user of an inbound SIP MESSAGE on a plus sign and treats the left half as a chat protocol selector. mod_dptools registers an 'api' chat interface that passes its address to switch_api_execute(), so a message selecting the api proto runs a sender-chosen FreeSWITCH API command, including OS command sinks; inline Lua via mod_lua is a second sink. Inbound chat is enabled on stock internal and external profiles and the inbound ACL does not cover MESSAGE. Any single accepted MESSAGE suffices: any valid account, or no account on installs using the stock conf/vanilla default user with no password unless allow-empty-password is false. Impact is command execution with the daemon's privileges, config and credential disclosure and call control. GHSA-mg63-h38w-8p9p (2026-10-28) and NVD state exploitation has been observed; CISA SSVC lists exploitation active, automatable yes, technical impact total. Fixed in 1.11.3 with a new per-profile enable-chat-api-proto parameter (off by default; 403 and logging when blocked).

CVE-2026-123158 (OpenSSH *sshole, CWE-394, CVSS 8.1 per MITRE): sshd before 10.6p2 on Linux built with musl libc and without PAM accepts any password of 257-1024 bytes for accounts whose shadow field is exactly '*'. musl's crypt() returns '*' as an error indicator for keys over 256 bytes, and without PAM sshd compares that return value to the stored '*', which matches. Conditions: PasswordAuthentication yes (default), an account with a '*' shadow field (root on Alpine with PermitRootLogin yes, key-only users, directory-service users, the 'alpine' user on tiny-cloud images with passwordless doas), and at least one other local account with a $5$ or $6$ hash. Alpine and OpenSSH released fixes 2026-11-05 (10.6p2). Third-party PoC/lab repositories exist. The CISA SSVC data in NVD lists exploitation active; the sshhole.com researcher page reported no confirmed in-the-wild exploitation at its writing, so treat the exploitation status as sourced from CISA KEV only.

CVE-2026-123218 (IBM Aspera Faspex 5.0.0-5.0.19, CWE-863, CVSS 9.8 per IBM): an authorized user can craft a specific message to bypass user authorization and obtain full administrative privileges. IBM's bulletin (published 2026-11-07) lists 5.0.19 PL1 as the fix (faspex-core image 5.0.19, 1ce4b13, Fix Pack 1) and no workarounds. The bulletin gives no exploitation details; the description requires an authorized user while the CVSS vector says PR:N, an inconsistency. No IOCs, attribution or actor are published for any of the four CVEs.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.004 SSH

Execution

T1059.004 Unix Shell

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application

Persistence

T1098 Account Manipulation

Credential Access

T1552 Unsecured Credentials

Remediation

Patches

• GPUStack 2.2.0
• FreeSWITCH 1.11.3
• OpenSSH 10.6p2; Alpine openssh 10.6_p2-r0 (edge), 10.3_p1-r2 (3.24), 10.2_p1-r1 (3.23), 10.0_p1-r11 (3.22), 9.9_p2-r1 (3.21)
• IBM Aspera Faspex 5.0.19 PL1 (faspex-core image 5.0.19, 1ce4b13, Fix Pack 1)

Immediate actions

• Upgrade GPUStack to 2.2.0 or later; until then set force_auth_localhost=true and strip X-GPUStack-Real-IP at the edge proxy
• Upgrade FreeSWITCH to 1.11.3 or later; until then set enable-chat=false on every sofia profile that does not need inbound SIP chat
• Upgrade OpenSSH to 10.6p2 (Alpine: apk upgrade -U -a, then restart sshd) or set PasswordAuthentication no
• Upgrade IBM Aspera Faspex 5 to 5.0.19 PL1
• Per BOD 26-04, remediate KEV-listed vulnerabilities on publicly exposed assets and check for compromise where patching was late

Workarounds

• GPUStack: force_auth_localhost=true; remove X-GPUStack-Real-IP at the gateway; restrict network exposure
• FreeSWITCH: enable-chat=false per profile; note auth-messages and disable_system_api_commands alone are insufficient
• OpenSSH/Alpine: PasswordAuthentication no (e.g. /etc/ssh/sshd_config.d/00-no-passwords.conf), verify with sshd -T, restart sshd
• IBM Aspera Faspex: none published by IBM

Longer-term hardening

• Do not expose GPUStack management APIs or FreeSWITCH SIP chat to untrusted networks; use VPN or edge authentication
• Do not derive authentication from network source or client-controlled forwarding headers
• Audit accounts with '*' shadow fields on musl-based hosts and prefer key-only SSH with password authentication disabled
• Rotate worker, cloud-provider, SIP and SSH credentials on any host where exploitation cannot be ruled out

Affected and fixed versions

• GPUStack — GPUStack
  Vulnerable versions: < 2.2.0 (exploitation reported against 2.1.1)
  Fixed in: 2.2.0
• SignalWire — FreeSWITCH
  Vulnerable versions: <= 1.11.2
  Fixed in: 1.11.3
• OpenBSD — OpenSSH (Portable, Linux with musl libc and no PAM, e.g. Alpine Linux)
  Vulnerable versions: < 10.6p2
  Fixed in: 10.6p2
• IBM — Aspera Faspex
  Vulnerable versions: 5.0.0 through 5.0.19
  Fixed in: 5.0.19 PL1

Timeline

• 2026-07-31 GPUStack publishes GHSA-gj9m-f8ph-pmhr for the loopback/X-GPUStack-Real-IP authentication bypass; 2.2.0 is the fixed release. Exploitation against a v2.1.1 deployment is reported (reverse-shell custom backends).
• 2026-10-28 FreeSWITCH publishes GHSA-mg63-h38w-8p9p for the SIP MESSAGE api-proto command execution flaw; 1.11.3 adds enable-chat-api-proto (default off). Advisory states exploitation has been observed.
• 2026-11-05 Alpine Linux and OpenSSH release fixes (OpenSSH 10.6p2) for the musl/no-PAM password authentication bypass (*sshole, CVE-2026-123158); Alpine advisory and locked-ioc-5 write-up published.
• 2026-11-07 IBM publishes the Aspera Faspex 5.0.0-5.0.19 authorization bypass bulletin (CVE-2026-123218); fix is 5.0.19 PL1, no workarounds.
• 2026-11-09 CISA adds CVE-2026-102895, CVE-2026-116779, CVE-2026-123158 and CVE-2026-123218 to the KEV Catalog, referencing BOD 26-04.
• 2026-11-12 KEV remediation due date recorded in NVD for CVE-2026-102895, CVE-2026-116779 and CVE-2026-123158.

Sources cited

Showing 15 of 16 sources, primary sources first.

• CISA Adds Four Known Exploited Vulnerabilities to Catalog CISA · Government advisory · 2026-11-09
• GPUStack GHSA-gj9m-f8ph-pmhr GitHub · Advisory · 2026-07-31
• FreeSWITCH GHSA-mg63-h38w-8p9p GitHub · Advisory · 2026-10-28
• CVE-2026-102895 NVD NVD (NIST) · Advisory · 2026-11-09
• CVE-2026-116779 NVD NVD (NIST) · Advisory · 2026-11-09
• CVE-2026-123158 NVD NVD (NIST) · Advisory · 2026-11-09
• CVE-2026-123218 NVD NVD (NIST) · Advisory · 2026-11-09
• GPUStack v2.2.0 release notes GitHub · Vendor report · 2026-07-31
• FreeSWITCH v1.11.3 release notes GitHub · Vendor report · 2026-10-28
• Alpine Linux: openssh-server password authentication bypass alpinelinux.org · Vendor report · 2026-11-05
• OpenSSH 10.6p2 release notes openssh.org · Vendor report · 2026-11-05
• sshhole.com *sshole technical write-up sshhole.com · Research · 2026-11-05
• IBM Security Bulletin: Aspera Faspex CVE-2026-123218 ibm.com · Vendor report · 2026-11-07
• OpenSSH patch commit 4353fdc GitHub · Code repository · 2026-11-05
• sshhole-lab PoC repository GitHub · Proof of concept · 2026-11-05

More in vulnerability

• Able2Shell: 33 N-able N-central Vulnerabilities Chained into RCE and Root Privilege Escalation; N-able Takes Hosted Cloud Offline
• Windows Dangling COM Object Registration Local Privilege Escalation (CVE-2026-66804, incomplete fix for CVE-2026-50343 'Dark Elevator')
• "Office Party" flaw in Anthropic Claude DOCX/PPTX/XLSX skills (soffice.py LD_PRELOAD shim) enables code execution on Linux
• ForgeRock Attack Chain: Default admin:admin Felix Console Credentials and WAF Path-Encoding Bypass Lead to RCE and Remote Vehicle Unlock at Two Automakers
• WidzialniCMS < 2.5 unauthenticated file upload RCE (CVE-2026-110468, CVE-2026-110469) plus reflected XSS (CVE-2026-112204) and login lockout bypass (CVE-2026-112205)