CVE-2026-26009: Catalyst Platform RCE Vulnerability

CVE-2026-26009 Overview

CVE-2026-26009 is a critical command injection vulnerability in Catalyst, a platform designed for enterprise game server hosts, game communities, and billing panel integrations. The vulnerability allows authenticated users with template.create or template.update permissions to execute arbitrary shell commands with root privileges on host systems due to improper sandboxing of install scripts.

Critical Impact

Users with template permissions can achieve full root-level remote code execution on every node machine in the cluster, potentially compromising the entire infrastructure.

Affected Products

• Catalyst game server management platform (versions prior to commit 11980aaf3f46315b02777f325ba02c56b110165d)

Discovery Timeline

• 2026-02-10 - CVE-2026-26009 published to NVD
• 2026-02-10 - Last updated in NVD database

Technical Details for CVE-2026-26009

Vulnerability Analysis

This vulnerability exists in the Catalyst platform's server template processing mechanism. Install scripts defined within server templates are executed directly on the host operating system as root using bash -c, without any sandboxing, containerization, or privilege restrictions. This design flaw allows any user with template.create or template.update permission to define arbitrary shell commands that will be executed with full root privileges.

The lack of input sanitization and execution isolation means that malicious scripts embedded in templates can perform any action the root user can perform, including reading sensitive files, installing backdoors, modifying system configurations, or pivoting to other systems in the cluster.

Root Cause

The root cause is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The application passes user-controlled template data directly to shell execution without proper validation, sanitization, or containment. The absence of containerization or privilege separation allows template scripts to run with the highest system privileges.

Attack Vector

The attack vector is network-based and requires low privileges (authenticated user with template permissions). An attacker with access to template creation or modification can embed malicious commands within install scripts. When these templates are deployed, the commands execute as root on the target node, enabling:

• Full system compromise of cluster nodes
• Data exfiltration from server infrastructure
• Lateral movement across the cluster
• Persistent backdoor installation
• Service disruption across all managed game servers

The security patch refactored the agent to replace host script execution with a containerized environment:

 use std::collections::{HashMap, HashSet};
 use std::os::unix::fs::MetadataExt;
 use std::path::PathBuf;
-use std::process::Stdio;
 use std::sync::Arc;
 use std::sync::OnceLock;
 use std::time::Duration;

Source: GitHub Commit Details

Detection Methods for CVE-2026-26009

Indicators of Compromise

• Unexpected processes spawned by the Catalyst agent running as root
• Unusual network connections originating from cluster nodes
• Suspicious modifications to server templates containing shell commands
• Audit logs showing template creation or updates with embedded commands

Detection Strategies

• Monitor process execution on Catalyst nodes for unexpected bash -c invocations with root privileges
• Implement template content scanning for suspicious shell commands before deployment
• Review authentication logs for unusual template permission assignments
• Enable file integrity monitoring on critical system files across cluster nodes

Monitoring Recommendations

• Configure centralized logging for all template modifications with content inspection
• Deploy endpoint detection and response (EDR) solutions on all cluster nodes to detect malicious process chains
• Establish baseline behavior for Catalyst agent activities and alert on deviations
• Monitor for privilege escalation attempts and unexpected root process execution

How to Mitigate CVE-2026-26009

Immediate Actions Required

• Update Catalyst to a version containing commit 11980aaf3f46315b02777f325ba02c56b110165d or later
• Audit all existing templates for malicious or suspicious install script content
• Review and restrict users with template.create and template.update permissions
• Monitor cluster nodes for signs of compromise until patching is complete

Patch Information

The vulnerability is fixed in commit 11980aaf3f46315b02777f325ba02c56b110165d. This patch refactors the Catalyst agent to replace direct host script execution with a containerized environment, preventing template scripts from accessing the host system with elevated privileges.

For more details, see the GitHub Security Advisory GHSA-xv5r-cpcw-8wr3 and the GitHub Commit Details.

Workarounds

• Temporarily revoke template.create and template.update permissions from all non-essential users
• Implement a manual review process for all template changes before deployment
• Consider network segmentation to limit blast radius if a node is compromised
• Deploy application-level firewalls to restrict outbound connections from cluster nodes

# Example: Temporarily revoke template permissions (implementation varies by deployment)
# Review your access control configuration and remove template permissions
# from users who do not require them until the patch is applied