CVE-2026-73519

Received Received - Intake

WolfStack Hard-Coded Secret Authentication Bypass

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: VulnCheck

Description

WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the require_auth() gate without any session, API key, or user account. Attackers can reach an affected node's management port to enumerate all Docker and LXC containers on the host and execute arbitrary commands as root inside any container via the POST /api/containers/{runtime}/{id}/exec endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-12

Generated

2026-08-13

AI Q&A

2026-08-13

EPSS Evaluated

N/A

NVD

CVE-2026-73519

EUVD

EUVD-2026-57638

Affected Vendors & Products

Vendor	Product	Version / Range
wolfstack	wolfstack	to 25.9.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-798	The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

Executive Summary

WolfStack before version 25.9.2 has a hard-coded secret in its authentication system. This secret is compiled into every build and exposed in the source code. Attackers can use this secret by sending a specific header (X-WolfStack-Secret) to bypass authentication entirely. No valid session, API key, or user account is required.

Detection Guidance

Check for the presence of the hard-coded cluster-authentication secret in WolfStack versions before 25.9.2. Inspect the src/auth/mod.rs file for the constant value. Monitor network traffic for requests containing the X-WolfStack-Secret header to management ports.

Impact Analysis

An attacker can remotely access the management port of an affected node. They can then list all Docker and LXC containers running on the host. Additionally, they can execute arbitrary commands as root inside any container using a specific API endpoint.

Mitigation Strategies

Upgrade WolfStack to version 25.9.2 or later to remove the hard-coded secret. Restrict access to management ports using firewalls. Disable or block the X-WolfStack-Secret header if detected in requests.

Hi! I’m here to help you understand CVE-2026-73519. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70