Both editorial notes arrive truncated mid-sentence ("replace t…" and "…on an unpa…"), so I applied the parts that are legible: added the KEV catalog link and softened the remediation absolutes. Re-send the full notes if the cut-off portions asked for more.
CVE-2026-73519: Hard-Coded Secret in WolfStack Grants Root Inside Every Container
A hard-coded cluster-authentication secret in WolfStack before 25.9.2 lets remote unauthenticated attackers bypass authentication entirely and run arbitrary commands as root inside any Docker or LXC container on an affected node.
What Is It
WolfStack ships a cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs. Because the value is public and identical across builds, the GitHub Security Advisory notes that anyone can present it in the X-WolfStack-Secret header to satisfy the require_auth() gate; no session, no API key, no user account required.
Once past that gate, according to VulnCheck's advisory, an attacker who can reach the node's management port can enumerate all Docker and LXC containers on the host and execute arbitrary commands as root inside any of them via POST /api/containers/{runtime}/{id}/exec.
The issue is tracked as CWE-798 (Use of Hard-coded Credentials) and was disclosed by VulnCheck.
Why It Matters
NVD assigns a CVSS 3.1 base score of 9.8 (Critical): AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and rates it 9.3 (Critical) under CVSS 4.0. Network-reachable, low complexity, no privileges, no user interaction, with high confidentiality, integrity, and availability impact.
The practical outcome is root-level command execution inside every container a compromised node manages. There is no credential to guess or brute-force; the secret is already published in source.
As of publication, CVE-2026-73519 is not listed in the CISA KEV catalog, and no public reporting of in-the-wild exploitation has surfaced. No federal remediation deadline applies.
What's Vulnerable
- Vendor: Wolf Software Systems Ltd
- Product: WolfStack
- Affected versions: all versions before 25.9.2 (semver
< 25.9.2, default status: affected) - Repository:
github.com/wolfsoftwaresystemsltd/WolfStack
Patch Status
Fixed in WolfStack 25.9.2. Upgrade to 25.9.2 or later. Because the secret is a compiled-in constant, upgrading is the primary remediation; no vendor-documented method exists for rotating the value on an unpatched build. Until upgraded, restrict network access to the management port.