CVE-2026-26009: Catalyst Affected by Remote Code Execution as Root via Containerized Install Script Execution

Published Feb 10, 2026

Updated

Catalyst is a platform built for enterprise game server hosts, game communities, and billing panel integrations. Install scripts defined in server templates execute directly on the host operating system as root via bash -c, with no sandboxing or containerization. Any user with template.create or template.update permission can define arbitrary shell commands that achieve full root-level remote code execution on every node machine in the cluster. This vulnerability is fixed in commit 11980aaf3f46315b02777f325ba02c56b110165d.

Affected Software

1 affected component

Catalyst Catalyst

Event History

Feb 10, 2026

CVE Published

via MITRE·06:58 PM

Data Sourced

via MITRE·06:58 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeakness

Sep 6, 58098

Event

via FIRST·11:03 AM

Frequently Asked Questions

What is the severity of CVE-2026-26009?

CVE-2026-26009 has been classified as a critical vulnerability due to its potential for remote code execution as root.

How do I fix CVE-2026-26009?

To fix CVE-2026-26009, apply the latest security updates from Catalyst that address the vulnerability in the install scripts.

What systems are affected by CVE-2026-26009?

CVE-2026-26009 affects systems running the Catalyst platform, particularly those using its install scripts on host operating systems.

What are the risks associated with CVE-2026-26009?

The risks associated with CVE-2026-26009 include unauthorized remote access and control over the affected system, potentially leading to data breaches.

Is there a workaround for CVE-2026-26009 until a fix is applied?

A possible workaround for CVE-2026-26009 is to disable the execution of install scripts or limit permissions on affected systems while awaiting a patch.