CVE-2026-73519 in WolfStack
Summary
by MITRE • 08/12/2026
WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the require_auth() gate without any session, API key, or user account. Attackers can reach an affected node's management port to enumerate all Docker and LXC containers on the host and execute arbitrary commands as root inside any container via the POST /api/containers/{runtime}/{id}/exec endpoint.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability in WolfStack versions prior to 25.9.2 represents a critical authentication bypass flaw that fundamentally compromises the security posture of affected systems. This issue stems from a hard-coded cluster-authentication secret that is embedded within every build of the software, making it permanently accessible to any attacker who can reach the management interface. The secret is published as a constant in the source code file src/auth/mod.rs, creating an inherent weakness that persists across all deployments without any possibility of remediation through configuration changes. This design flaw directly violates security best practices by embedding credentials within the application binary rather than implementing proper authentication mechanisms.
The technical implementation of this vulnerability allows remote unauthenticated attackers to bypass all authentication gates by simply including the hard-coded secret in the X-WolfStack-Secret header when making requests to protected endpoints. The require_auth() gate, which should enforce proper authentication protocols, becomes completely ineffective when this header is present with the correct value. This authentication bypass enables attackers to access management interfaces that should be restricted to authorized users only, effectively granting them administrative privileges without requiring any legitimate credentials, session tokens, API keys, or user accounts. The vulnerability operates at the network level and can be exploited from any location with internet connectivity to the affected system.
The operational impact of this vulnerability extends far beyond simple authentication bypass, as it provides attackers with complete control over containerized environments managed by WolfStack. Once authenticated, attackers can enumerate all Docker and LXC containers running on the host system through the management interface, exposing the entire container landscape to unauthorized inspection. This enumeration capability allows attackers to identify sensitive workloads, understand system architecture, and plan further exploitation strategies. The most severe consequence occurs when attackers leverage the POST /api/containers/{runtime}/{id}/exec endpoint to execute arbitrary commands as root within any container, effectively providing them with complete system compromise capabilities. This privilege escalation enables attackers to modify or exfiltrate data, establish persistence mechanisms, or use the compromised containers as launch points for further attacks within the network infrastructure.
Security organizations should recognize this vulnerability as a classic example of credential hardcoding that aligns with CWE-259 and CWE-798, representing persistent security flaws that remain exploitable across all system instances. The attack surface identified through the MITRE ATT&CK framework demonstrates multiple techniques including credential access through hard-coded credentials and privilege escalation via container execution capabilities. Organizations should immediately implement mitigations including patching to version 25.9.2 or later, disabling management ports when not required, implementing network segmentation controls, and conducting thorough audits of all deployed instances to ensure no systems remain vulnerable. Additionally, security monitoring should be enhanced to detect unauthorized access attempts using the specific X-WolfStack-Secret header pattern, as this represents a unique fingerprint that attackers must use to exploit the vulnerability. The incident underscores the critical importance of proper credential management and the dangers of embedding authentication secrets within application code rather than implementing robust authentication frameworks.