CVE-2026-73519: WolfStack Authentication Bypass Vulnerability

CVE-2026-73519 Overview

CVE-2026-73519 is a critical authentication bypass vulnerability in WolfStack versions before 25.9.2. The flaw stems from a hard-coded cluster-authentication secret compiled into every build and published as a public constant in src/auth/mod.rs. Remote unauthenticated attackers can supply this value in the X-WolfStack-Secret HTTP header to bypass the require_auth() gate entirely. Successful exploitation grants attackers full access to enumerate Docker and LXC containers on the host and execute arbitrary commands as root inside any container through the POST /api/containers/{runtime}/{id}/exec endpoint. The vulnerability is classified under [CWE-798] (Use of Hard-coded Credentials).

Critical Impact
Remote unauthenticated attackers can execute arbitrary commands as root inside any Docker or LXC container managed by an affected WolfStack node.

Affected Products

WolfStack versions prior to 25.9.2
Deployments exposing the WolfStack management port to untrusted networks
All builds that ship the constant defined in src/auth/mod.rs

Discovery Timeline

2026-08-12 - CVE CVE-2026-73519 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73519

Vulnerability Analysis

WolfStack ships a static shared secret embedded in the compiled binary. The authentication middleware, implemented in the require_auth() function inside src/auth/mod.rs, accepts the X-WolfStack-Secret header as a valid credential path. Because the secret is a source-level constant, every build across every deployment shares an identical value that can be extracted directly from the public repository.

An attacker who reaches the management API port can present this header value on any request. The gate returns without requiring a session cookie, API key, or user account context. Once past authentication, the attacker gains the full privileges of the WolfStack management plane, which orchestrates containers as root on the host.

The most significant post-authentication capability is the container exec endpoint. This endpoint accepts a runtime identifier (Docker or LXC), a container ID, and a command payload, then runs the command inside the target container with root privileges.

Root Cause

The root cause is the storage of a cluster-authentication secret as a compiled-in constant in a public source file. This design violates the principle that shared secrets must be provisioned per deployment and never distributed inside published artifacts. Any party with access to the repository or a binary can recover the value.

Attack Vector

Exploitation requires only network reachability to the WolfStack management port. The attacker crafts an HTTP request against /api/containers/{runtime}/{id}/exec, sets the X-WolfStack-Secret header to the known constant value, and specifies the container and command to run. No prior credentials, user interaction, or reconnaissance beyond identifying an exposed node is required.

Refer to the VulnCheck Advisory on Authentication Bypass and the GitHub Security Advisory for additional technical detail.

Detection Methods for CVE-2026-73519

Indicators of Compromise

HTTP requests to any WolfStack endpoint containing the X-WolfStack-Secret header, especially from external or non-management source addresses
POST requests to /api/containers/{runtime}/{id}/exec that did not originate from an authenticated administrative session
Unexpected container processes spawned as root, particularly reverse shells, package installers, or credential-harvesting binaries
New or modified files inside containers with no corresponding deployment or CI/CD activity

Detection Strategies

Inspect reverse proxy and web server logs for the literal header name X-WolfStack-Secret and alert on any occurrence from non-trusted networks
Baseline expected callers of the container exec endpoint and flag deviations by source IP, user agent, or time of day
Correlate container exec events from Docker and LXC audit logs with authenticated WolfStack session activity to surface unexplained executions

Monitoring Recommendations

Enable and forward Docker daemon and LXC audit logs to a centralized log platform for retention and searchability
Monitor egress from container hosts for outbound connections to unknown destinations following exec API activity
Track process ancestry on container hosts so that child processes of the WolfStack service become visible to detection tooling

How to Mitigate CVE-2026-73519

Immediate Actions Required

Upgrade WolfStack to version 25.9.2 or later without delay
Restrict network access to the WolfStack management port to trusted administrative networks only
Review Docker and LXC container inventories for signs of unauthorized exec activity or persistence artifacts
Rotate any credentials, tokens, or keys stored inside containers that may have been exposed to an attacker

Patch Information

The vendor released a fix in GitHub Release v25.9.2. Administrators should consult the GitHub Security Advisory for upgrade instructions and validation guidance.

Workarounds

Place the WolfStack management port behind a firewall or VPN that denies all traffic from untrusted sources
Configure a reverse proxy to strip or reject any request containing the X-WolfStack-Secret header until the patch is applied
Take affected nodes offline if segmentation controls cannot be enforced before upgrading

bash

# Example reverse proxy rule to block the vulnerable header (nginx)
if ($http_x_wolfstack_secret) {
    return 403;
}