Vulnerability Description
WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the require_auth() gate without any session, API key, or user account. Attackers can reach an affected node's management port to enumerate all Docker and LXC containers on the host and execute arbitrary commands as root inside any container via the POST /api/containers/{runtime}/{id}/exec endpoint.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/wolfsoftwaresystemsltd/WolfStack/releases?page=7#release-v25.
- https://github.com/wolfsoftwaresystemsltd/WolfStack/security/advisories/GHSA-r3m
- https://www.vulncheck.com/advisories/wolfstack-hard-coded-secret-authentication-
FAQ
What is CVE-2026-73519?
CVE-2026-73519 is a vulnerability with a CVSS score of 9.8 (CRITICAL). WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypas...
How severe is CVE-2026-73519?
CVE-2026-73519 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-73519?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.