Vulnerability · Published Aug 12, 2026 · Assigned by VulnCheck

CVE-2026-73519WolfStack < 25.9.2 Hard-coded Secret Authentication Bypass via X-WolfStack-Secret

Critical 9.8

In plain English

A critical-severity hard-coded credentials in WolfStack from wolfsoftwaresystemsltd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.2%top 30.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the require_auth() gate without any session, API key, or user account. Attackers can reach an affected node's management port to enumerate all Docker and LXC containers on the host and execute arbitrary commands as root inside any container via the POST /api/containers/{runtime}/{id}/exec endpoint.

Affected products (as reported)

Vendor	Product	Versions
wolfsoftwaresystemsltd	WolfStack	0 – before 25.9.2

Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-r3mw-2wmq-j6jg) vendor-advisory
Release Notes release-notes
https://www.vulncheck.com/advisories/wolfstack-hard-coded-secret-authentication-bypass-via-x-wolfstack-secret third-party-advisory