CVE-2026-102895 (and CVE-2026-102894) GPUStack defensive kit
=============================================================
LAB-ONLY / DEFENSIVE USE. Offline. Reads files you export yourself. Sends no
requests to any GPUStack server. Contains no exploit or payload code.

gpustack-102895-audit.py inventory inventory.csv
  CSV columns: name,version,force_auth_localhost,same_host_proxy,strips_real_ip_header
gpustack-102895-audit.py nginx /etc/nginx
  Flags proxy_pass to 127.0.0.1/localhost without proxy_set_header X-GPUStack-Real-IP "".
gpustack-102895-audit.py accesslog /var/log/nginx/access.log
  Lists POST /v2/inference-backends/from-yaml (admin-only, abused in the wild per advisory).
gpustack-102895-mitigate.sh <nginx-site> <gpustack-config.yaml> [--apply]
  Dry run by default. Interim workarounds from GHSA-gj9m-f8ph-pmhr.

Fixed versions: gpustack 2.2.0 (CVE-2026-102895), 2.2.2 (CVE-2026-102894).
Upgrade to 2.2.2 or later and recreate the container. Then audit admin API
keys and inference backends: the fix does not revoke keys already minted.
Sources: GHSA-gj9m-f8ph-pmhr, CVE-2026-102895 record, CISA KEV 2026-11-09.
