CVE-2026-26009: Catalyst Platform RCE Vulnerability

CVE-2026-26009 Overview

CVE-2026-26009 is a critical command injection vulnerability in Catalyst, a platform designed for enterprise game server hosts, game communities, and billing panel integrations. The vulnerability allows authenticated users with template.create or template.update permissions to execute arbitrary shell commands with root privileges on host systems due to improper sandboxing of install scripts.

Critical Impact
Users with template permissions can achieve full root-level remote code execution on every node machine in the cluster, potentially compromising the entire infrastructure.

Affected Products

Catalyst game server management platform (versions prior to commit 11980aaf3f46315b02777f325ba02c56b110165d)

Discovery Timeline

2026-02-10 - CVE-2026-26009 published to NVD
2026-02-10 - Last updated in NVD database

Technical Details for CVE-2026-26009

Vulnerability Analysis

This vulnerability exists in the Catalyst platform's server template processing mechanism. Install scripts defined within server templates are executed directly on the host operating system as root using bash -c, without any sandboxing, containerization, or privilege restrictions. This design flaw allows any user with template.create or template.update permission to define arbitrary shell commands that will be executed with full root privileges.

The lack of input sanitization and execution isolation means that malicious scripts embedded in templates can perform any action the root user can perform, including reading sensitive files, installing backdoors, modifying system configurations, or pivoting to other systems in the cluster.

Root Cause

The root cause is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The application passes user-controlled template data directly to shell execution without proper validation, sanitization, or containment. The absence of containerization or privilege separation allows template scripts to run with the highest system privileges.

Attack Vector

The attack vector is network-based and requires low privileges (authenticated user with template permissions). An attacker with access to template creation or modification can embed malicious commands within install scripts. When these templates are deployed, the commands execute as root on the target node, enabling:

Full system compromise of cluster nodes
Data exfiltration from server infrastructure
Lateral movement across the cluster
Persistent backdoor installation
Service disruption across all managed game servers

The security patch refactored the agent to replace host script execution with a containerized environment:

rust

 use std::collections::{HashMap, HashSet};
 use std::os::unix::fs::MetadataExt;
 use std::path::PathBuf;
-use std::process::Stdio;
 use std::sync::Arc;
 use std::sync::OnceLock;
 use std::time::Duration;

Source: GitHub Commit Details

Detection Methods for CVE-2026-26009

Indicators of Compromise

Unexpected processes spawned by the Catalyst agent running as root
Unusual network connections originating from cluster nodes
Suspicious modifications to server templates containing shell commands
Audit logs showing template creation or updates with embedded commands

Detection Strategies

Monitor process execution on Catalyst nodes for unexpected bash -c invocations with root privileges
Implement template content scanning for suspicious shell commands before deployment
Review authentication logs for unusual template permission assignments
Enable file integrity monitoring on critical system files across cluster nodes

Monitoring Recommendations

Configure centralized logging for all template modifications with content inspection
Deploy endpoint detection and response (EDR) solutions on all cluster nodes to detect malicious process chains
Establish baseline behavior for Catalyst agent activities and alert on deviations
Monitor for privilege escalation attempts and unexpected root process execution

How to Mitigate CVE-2026-26009

Immediate Actions Required

Update Catalyst to a version containing commit 11980aaf3f46315b02777f325ba02c56b110165d or later
Audit all existing templates for malicious or suspicious install script content
Review and restrict users with template.create and template.update permissions
Monitor cluster nodes for signs of compromise until patching is complete

Patch Information

The vulnerability is fixed in commit 11980aaf3f46315b02777f325ba02c56b110165d. This patch refactors the Catalyst agent to replace direct host script execution with a containerized environment, preventing template scripts from accessing the host system with elevated privileges.

For more details, see the GitHub Security Advisory GHSA-xv5r-cpcw-8wr3 and the GitHub Commit Details.

Workarounds

Temporarily revoke template.create and template.update permissions from all non-essential users
Implement a manual review process for all template changes before deployment
Consider network segmentation to limit blast radius if a node is compromised
Deploy application-level firewalls to restrict outbound connections from cluster nodes

bash

# Example: Temporarily revoke template permissions (implementation varies by deployment)
# Review your access control configuration and remove template permissions
# from users who do not require them until the patch is applied