CVE-2026-73519 wolfsoftwaresystemsltd CVE debrief

Who should care

Defenders and administrators responsible for WolfStack deployments should assess exposure and prioritize remediation. This vulnerability has a high CVSS score and is considered critical, indicating a high risk of exploitation and potential impact on affected systems.

Why it matters

CVE-2026-73519 is a critical vulnerability in WolfStack that allows remote unauthenticated attackers to bypass authentication and execute arbitrary commands as root inside any container. Defenders and administrators responsible for WolfStack deployments should assess exposure and prioritize remediation.

• Remote unauthenticated attackers can bypass authentication
• Enumeration of Docker and LXC containers on the host is possible
• Execution of arbitrary commands as root inside any container is possible
• Verification of WolfStack version and patch level is necessary

Technical summary

The WolfStack software system contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs. This allows remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the require_auth() gate without any session, API key, or user account. Attackers can then reach an affected node's management port to enumerate all Docker and LXC containers on the host and execute arbitrary commands as root inside any container via the POST /api/containers/{runtime}/{id}/exec endpoint.

Defensive priority

High

Recommended defensive actions

• Review and update WolfStack to version 25.9.2 or later
• Implement additional authentication mechanisms
• Monitor for suspicious activity on the management port
• Verify WolfStack version and patch level
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD vulnerability detail page provide information about the vulnerability, including its description, CVSS score, and affected product. However, the vendor and product names are not specified, and the vulnerability status is listed as 'Deferred'.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.