Description

WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the require_auth() gate without any session, API key, or user account. Attackers can reach an affected node's management port to enumerate all Docker and LXC containers on the host and execute arbitrary commands as root inside any container via the POST /api/containers/{runtime}/{id}/exec endpoint.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-12T22:17:17.600Z",
  "pubdate": "2026-08-12T22:17:17.600Z",
  "executiveSummary": "WolfStack before version 25.9.2 suffers from a critical hard-coded cluster-authentication secret vulnerability.\nThis flaw allows remote unauthenticated attackers to completely bypass authentication gates and gain administrative access to affected nodes.\nThe vulnerability affects WolfStack deployments utilizing software versions prior to 25.9.2, exposing the management port to unauthorized entities.\nAn attacker can exploit this weakness without possessing any session tokens, API keys, or valid user accounts.\nSuccessful exploitation results in severe risk implications, granting malicious actors the capability to enumerate system assets and achieve arbitrary command execution as root.\nAttackers can leverage this access to target Docker and LXC containers directly, compromising the confidentiality, integrity, and availability of the underlying host and hosted environments.",
  "technicalDetails": "The root cause of the vulnerability is the inclusion of a hard-coded cluster-authentication secret compiled directly into every build and published as a constant within src/auth/mod.rs.\nThe vulnerable component is the require_auth() gate, which evaluates incoming requests for authentication credentials.\nAffected versions include all WolfStack deployments prior to version 25.9.2.\nAuthentication requirements are entirely bypassed, as the vulnerability requires zero authentication credentials, sessions, API keys, or user accounts.\nPrivilege requirements are nonexistent for the initial entry, but exploitation yields root privileges inside targeted execution environments.\nNetwork exposure involves the management port of the affected WolfStack node, which is reachable by remote unauthenticated attackers.\nThe attack flow proceeds as follows: an attacker identifies an exposed management port on an affected WolfStack node. The attacker crafts an HTTP request targeting the service and includes the hard-coded secret value within the X-WolfStack-Secret header. This value is evaluated by the require_auth() function, which improperly validates and accepts the static constant as valid authentication.\nOnce the authentication gate is bypassed, payload behavior and post-exploitation impact include reaching the management interface to enumerate all Docker and LXC containers residing on the host.\nFollowing container enumeration, the attacker can interact with the POST /api/containers/{runtime}/{id}/exec endpoint to execute arbitrary commands as root inside any targeted Docker or LXC container, resulting in full compromise of the containerized workloads and potential host-level escalation paths."
}