🟠 《高危安全漏洞：CVE-2026-58658》

CVSS 评分: 高危（8.8）　　状态: Received　　发布时间: 2026-07-15

漏洞描述

GPUStack through 2.2.1, fixed in commit 4e20551, contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to access sensitive inference logs and modify worker configuration by exploiting unprotected /serveLogs and /debug endpoints on the worker port. Attackers can enumerate model instance IDs to stream serving logs containing prompts and completions, change log levels, and read memory profiling data without any authentication.

🔍 技术细节

字段 值
CVE ID CVE-2026-58658
CVSS 评分 8.8 🟠
严重程度 高危
CVSS 向量 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE 分类 CWE-306
发布时间 2026-07-15
最后更新 2026-07-15
状态 Received
数据来源 disclosure@vulncheck.com

🔗 参考链接