CVE-2026-73519: WolfStack < 25.9.2 Hard-coded Secret Authentication Bypass via X-WolfStack-Secret
WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the requireauth() gate without any session, API key, or user account. Attackers can reach an affected node's management port to enumerate all Docker and LXC containers on the host and execute arbitrary commands as root inside any container via the POST /api/containers/{runtime}/{id}/exec endpoint.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73519?
CVE-2026-73519 has a critical severity score of 9.8 on the CVSS scale.
How do I fix CVE-2026-73519?
To fix CVE-2026-73519, upgrade to WolfStack version 25.9.2 or later, which removes the hard-coded secret.
What type of vulnerability is CVE-2026-73519?
CVE-2026-73519 is an authentication bypass vulnerability caused by a hard-coded secret.
Who can exploit CVE-2026-73519?
CVE-2026-73519 can be exploited by remote unauthenticated attackers.
What impact does CVE-2026-73519 have on systems?
CVE-2026-73519 allows attackers to bypass authentication, gaining unauthorized access to systems.