A spoofable X-GPUStack-Real-IP header lets a remote attacker impersonate the loopback admin account in GPUStack, gaining full administrative control and code execution with no credentials.