---
id: CVE-2026-73519
title: >-
  WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret
  compiled into every build and published as a constant in src/auth/mod.rs,
  allowing remote unauthenticated attackers to bypass authentication by
  supplying this va…
summary: >-
  WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret
  compiled into every build and published as a constant in src/auth/mod.rs,
  allowing remote unauthenticated attackers to bypass authentication by
  supplying this va…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-798
published: '2026-08-12'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:32:12.967'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73519'
references:
  - url: >-
      https://github.com/wolfsoftwaresystemsltd/WolfStack/releases?page=7#release-v25.9.2
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/wolfsoftwaresystemsltd/WolfStack/security/advisories/GHSA-r3mw-2wmq-j6jg
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/wolfstack-hard-coded-secret-authentication-bypass-via-x-wolfstack-secret
    label: disclosure@vulncheck.com
tags:
  - nvd
  - exploit-available
epss: 0.01241
epssPercentile: 0.67922
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/squeeze440/CVE-2026-73519-WolfStack-PoC'
  checkedAt: '2026-09-26T09:05:58.949Z'
exploitAvailable: true
ingestedAt: '2026-09-24T20:51:40.199Z'
---

## Overview

WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the require_auth() gate without any session, API key, or user account. Attackers can reach an affected node's management port to enumerate all Docker and LXC containers on the host and execute arbitrary commands as root inside any container via the POST /api/containers/{runtime}/{id}/exec endpoint.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.