# CISA adds four KEVs: GPUStack CVE-2026-102895, SignalWire FreeSwitch CVE-2026-116779, OpenBSD OpenSSH CVE-2026-123158, IBM Aspera Faspex CVE-2026-123218

> On 2026-11-09 CISA added four vulnerabilities to the KEV Catalog: a GPUStack loopback/header authentication bypass leading to admin access and code execution, a FreeSWITCH SIP MESSAGE API-command injection, an OpenSSH (musl libc, no PAM) password authentication bypass known as *sshole, and an IBM Aspera Faspex 5 authorization bypass granting full administrative privileges. CISA's alert references BOD 26-04 for Federal Civilian Executive Branch remediation.

- **Published:** 2026-11-09T21:22:14Z
- **Last reviewed:** 2026-11-09T21:22:14Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5587
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5587.png
- **ID:** TL-2026-5587
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 9 (3 shown free below)
- **CVEs:** CVE-2026-102895, CVE-2026-116779, CVE-2026-123158, CVE-2026-123218

## Description

CISA's 2026-11-09 alert adds four CVEs to the Known Exploited Vulnerabilities catalog. The alert itself gives only the vendor, product and weakness class for each; technical detail comes from the vendor advisories and CVE records. NVD records for the first two CVEs give a KEV remediation due date of 2026-11-12, and the OpenSSH record gives the same date.

CVE-2026-102895 (GPUStack, CWE-287/290/346, CVSS 9.8): versions before 2.2.0 treat requests that appear to originate from loopback as the built-in administrator when force_auth_localhost is false (the default). get_current_user in gpustack/api/auth.py relies on client_ip_getter. Two paths exist: a same-host reverse proxy using proxy_pass to 127.0.0.1 makes every remote request arrive from a loopback peer, and a client-supplied X-GPUStack-Real-IP: 127.0.0.1 header spoofs the source. With admin access an attacker can enumerate and modify users, models, workers and configuration, mint persistent admin API keys with scope ["*"] usable from any IP, read worker and cloud-provider secrets, and reach code execution on worker hosts through the admin-only POST /v2/inference-backends/from-yaml endpoint. The GitHub advisory (GHSA-gj9m-f8ph-pmhr, published 2026-07-31) reports exploitation in the wild against a v2.1.1 deployment where attackers created custom inference backends running reverse shells. Fixed in 2.2.0.

CVE-2026-116779 (FreeSWITCH, CWE-77/78/749, CVSS 9.8): before 1.11.3, sofia_presence_handle_sip_i_message() splits the To user of an inbound SIP MESSAGE on a plus sign and treats the left half as a chat protocol selector. mod_dptools registers an 'api' chat interface that passes its address to switch_api_execute(), so a message selecting the api proto runs a sender-chosen FreeSWITCH API command, including OS command sinks; inline Lua via mod_lua is a second sink. Inbound chat is enabled on stock internal and external profiles and the inbound ACL does not cover MESSAGE. Any single accepted MESSAGE suffices: any valid account, or no account on installs using the stock conf/vanilla default user with no password unless allow-empty-password is false. Impact is command execution with the daemon's privileges, config and credential disclosure and call control. GHSA-mg63-h38w-8p9p (2026-10-28) and NVD state exploitation has been observed; CISA SSVC lists exploitation active, automatable yes, technical impact total. Fixed in 1.11.3 with a new per-profile enable-chat-api-proto parameter (off by default; 403 and logging when blocked).

CVE-2026-123158 (OpenSSH *sshole, CWE-394, CVSS 8.1 per MITRE): sshd before 10.6p2 on Linux built with musl libc and without PAM accepts any password of 257-1024 bytes for accounts whose shadow field is exactly '*'. musl's crypt() returns '*' as an error indicator for keys over 256 bytes, and without PAM sshd compares that return value to the stored '*', which matches. Conditions: PasswordAuthentication yes (default), an account with a '*' shadow field (root on Alpine with PermitRootLogin yes, key-only users, directory-service users, the 'alpine' user on tiny-cloud images with passwordless doas), and at least one other local account with a $5$ or $6$ hash. Alpine and OpenSSH released fixes 2026-11-05 (10.6p2). Third-party PoC/lab repositories exist. The CISA SSVC data in NVD lists exploitation active; the sshhole.com researcher page reported no confirmed in-the-wild exploitation at its writing, so treat the exploitation status as sourced from CISA KEV only.

CVE-2026-123218 (IBM Aspera Faspex 5.0.0-5.0.19, CWE-863, CVSS 9.8 per IBM): an authorized user can craft a specific message to bypass user authorization and obtain full administrative privileges. IBM's bulletin (published 2026-11-07) lists 5.0.19 PL1 as the fix (faspex-core image 5.0.19, 1ce4b13, Fix Pack 1) and no workarounds. The bulletin gives no exploitation details; the description requires an authorized user while the CVSS vector says PR:N, an inconsistency. No IOCs, attribution or actor are published for any of the four CVEs.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1059.004 Unix Shell
- T1098 Account Manipulation
- T1552 Unsecured Credentials
- T1021.004 SSH

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**GPUStack X-GPUStack-Real-IP Loopback Spoof Authentication Bypass (CVE-2026-102895)** (`TL-2026-5587-SPL-001`)

Detects HTTP requests carrying an X-GPUStack-Real-IP header set to a loopback address (127.x or ::1). GPUStack before 2.2.0 trusts client_ip_getter for admin identity, so a remote client that spoofs this header is treated as the built-in administrator. Legitimate clients and proxies never send this header with a loopback value, so any hit is a strong exploitation signal for TL-2026-5587 / CISA KEV CVE-2026-102895. Requires the ingress, reverse-proxy or WAF log to record request headers or raw header text.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1078
- **Data sources:** nginx:access, access_combined, ingress:nginx, CommonSecurityLog, webserver
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=web sourcetype IN ("nginx:access","access_combined","ingress:nginx","aws:elb:accesslogs") ("X-GPUStack-Real-IP" OR "x_gpustack_real_ip" OR "gpustack_real_ip") | rex field=_raw "(?i)x[-_]gpustack[-_]real[-_]ip[^0-9a-f:.]+(?<spoofed_ip>[0-9a-f:.]+)" | where match(spoofed_ip,"^(127[.]|::1$|0:0:0:0:0:0:0:1$)") | stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as uris values(status) as statuses by src, dest, spoofed_ip | convert ctime(first_seen) ctime(last_seen) | table first_seen last_seen src dest spoofed_ip uris statuses count
```

### Microsoft KQL

```kql
CommonSecurityLog | where TimeGenerated > ago(24h) | where * has "X-GPUStack-Real-IP" or * has "x_gpustack_real_ip" | extend Spoofed = extract(@"(?i)x[-_]gpustack[-_]real[-_]ip[^0-9a-f:.]+([0-9a-f:.]+)", 1, tostring(pack_all())) | where Spoofed startswith "127." or Spoofed in ("::1", "0:0:0:0:0:0:0:1") | project TimeGenerated, DeviceVendor, SourceIP, DestinationIP, RequestMethod, RequestURL, Spoofed, DeviceAction
```

### Sigma

```yaml
title: GPUStack Loopback Authentication Bypass via X-GPUStack-Real-IP Header Spoofing (CVE-2026-102895)
id: 7b1c2a54-3d0e-4f6a-9a1b-5c8e1d2f4a01
status: experimental
description: Detects HTTP requests that carry an X-GPUStack-Real-IP header with a loopback value, used to spoof the client source and obtain built-in administrator access on GPUStack before 2.2.0. Requires web or proxy logs that record request headers.
references:
  - https://github.com/gpustack/gpustack/security/advisories/GHSA-gj9m-f8ph-pmhr
  - https://www.cisa.gov/news-events/alerts/2026/11/09/cisa-adds-four-known-exploited-vulnerabilities-catalog
author: Threadlinqs Team
date: 2026-11-09
tags:
  - attack.initial-access
  - attack.t1190
  - attack.t1078
  - cve.2026.102895
logsource:
  category: webserver
detection:
  keywords:
    - 'X-GPUStack-Real-IP: 127.0.0.1'
    - 'X-GPUStack-Real-IP: ::1'
    - 'x_gpustack_real_ip=127.0.0.1'
    - 'x_gpustack_real_ip=::1'
  condition: keywords
falsepositives:
  - Internal security testing or vulnerability scanning against GPUStack
  - Custom in-house proxy that deliberately forwards a loopback value in this header
level: critical
```

**Known false positives:**

- Authorized penetration tests or vulnerability scans replaying the CVE-2026-102895 header
- Custom in-house proxy configured to forward a loopback value in X-GPUStack-Real-IP

**Tuning notes:** Enable request-header logging at the edge (nginx log_format with $http_x_gpustack_real_ip, WAF header capture). Exclude scanner source IPs during authorized tests. Also strip this header at the gateway as per vendor workaround. Extend the index and sourcetype list to match your proxy.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- IBM Aspera Faspex 5 Administrative API Writes from Unexpected Principal (CVE-2026-123218) (locked: unlock with TL Creds)
- GPUStack Process Spawning Reverse Shell on Worker or Server Host (CVE-2026-102895) (locked: unlock with TL Creds)
- FreeSWITCH Daemon Spawning Shell or Download Tool (CVE-2026-116779) (locked: unlock with TL Creds)
- GPUStack POST to /v2/inference-backends/from-yaml Admin Endpoint (CVE-2026-102895) (locked: unlock with TL Creds)
- GPUStack Admin API Key Creation from External Source (CVE-2026-102895) (locked: unlock with TL Creds)
- Credential File Harvesting from SSH or Interactive Shell on Linux Host (locked: unlock with TL Creds)
- FreeSWITCH SIP MESSAGE api+ Command Injection (CVE-2026-116779) (locked: unlock with TL Creds)
- OpenSSH *sshole Password Login to Key-Only Accounts on musl Hosts (CVE-2026-123158) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 9)

Defanged, TLP:CLEAR.

- Domain: `sshhole[.]com`
- URL: `hxxps://github[.]com/leonjza/sshhole-lab`
- URL: `hxxps://github[.]com/predkambrij/sshhole-repro`

Full set of 9 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [CISA Adds Four Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/11/09/cisa-adds-four-known-exploited-vulnerabilities-catalog)
- [GPUStack GHSA-gj9m-f8ph-pmhr](https://github.com/gpustack/gpustack/security/advisories/GHSA-gj9m-f8ph-pmhr)
- [GPUStack v2.2.0 release notes](https://github.com/gpustack/gpustack/releases/tag/v2.2.0)
- [FreeSWITCH GHSA-mg63-h38w-8p9p](https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p)
- [FreeSWITCH v1.11.3 release notes](https://github.com/signalwire/freeswitch/releases/tag/v1.11.3)
- [Alpine Linux: openssh-server password authentication bypass](https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/)
- [OpenSSH 10.6p2 release notes](https://www.openssh.org/releasenotes.html#10.6p2)
- [OpenSSH patch commit 4353fdc](https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482)
- [sshhole.com *sshole technical write-up](https://sshhole.com/)
- [sshhole-lab PoC repository](https://github.com/leonjza/sshhole-lab)
- [sshhole-repro PoC repository](https://github.com/predkambrij/sshhole-repro)
- [IBM Security Bulletin: Aspera Faspex CVE-2026-123218](https://www.ibm.com/support/pages/node/7295921)
- [CVE-2026-102895 NVD](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-102895)
- [CVE-2026-116779 NVD](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-116779)
- [CVE-2026-123158 NVD](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-123158)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5587