Executive brief
WolfStack is a container and infrastructure management platform. Versions before 25.9.2 contain a hard-coded authentication secret compiled into every build, allowing unauthenticated remote attackers to bypass security controls, enumerate all containers on a host, and execute arbitrary commands as root inside containers. This breaks the entire authentication model and puts customer data and operations at severe risk.
Technical details
WolfStack compiled a single cluster-authentication secret into the binary and published it as a constant in src/auth/mod.rs. The require_auth() gate, used across the REST API, accepts this value in the X-WolfStack-Secret header as valid cluster-node authentication with no session, API key, or user account required. An unauthenticated remote attacker reaching the management port can enumerate Docker and LXC containers and execute arbitrary commands as root via POST /api/containers/{runtime}/{id}/exec. Affected nodes are those using the built-in default (no custom secret file, upgrades from older builds, or intentionally accepting the default via WOLFSTACK_ACCEPT_DEFAULT_SECRET=1). Version 25.9.2 restricts the built-in default to requests from recorded cluster peers only; version 25.9.3 and 25.21.3 further restrict command-execution endpoints to require operator identity, but partial bypasses required version 25.21.3 for complete remediation.
Affected products
- Wolf Software Systems Ltd WolfStack before 25.9.2; also 25.9.3 through 25.21.2
Timeline
- 2026-08-01: disclosed: GitHub Security Advisory GHSA-r3mw-2wmq-j6jg published
- 2026-08-12: advisory: CVE-2026-73519 published
- 2026-08-12: patched: Version 25.9.2 released
- 2026-08-29: other: Revision 2: hardening in 25.9.3 found incomplete; fixed in 25.21.3