{"id":"CVE-2026-73519","summary":"WolfStack \u003c 25.9.2 Hard-coded Secret Authentication Bypass via X-WolfStack-Secret","details":"WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the require_auth() gate without any session, API key, or user account. Attackers can reach an affected node's management port to enumerate all Docker and LXC containers on the host and execute arbitrary commands as root inside any container via the POST /api/containers/{runtime}/{id}/exec endpoint.","aliases":["GHSA-r3mw-2wmq-j6jg"],"modified":"2026-08-15T11:30:57.654761357Z","published":"2026-08-12T21:15:33.164Z","database_specific":{"cwe_ids":["CWE-798"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73519.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73519.json"},{"type":"ADVISORY","url":"https://github.com/wolfsoftwaresystemsltd/WolfStack/releases?page=7#release-v25.9.2"},{"type":"ADVISORY","url":"https://github.com/wolfsoftwaresystemsltd/WolfStack/security/advisories/GHSA-r3mw-2wmq-j6jg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73519"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/wolfstack-hard-coded-secret-authentication-bypass-via-x-wolfstack-secret"},{"type":"PACKAGE","url":"https://github.com/wolfsoftwaresystemsltd/WolfStack"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/wolfsoftwaresystemsltd/wolfstack","events":[{"introduced":"0"},{"fixed":"3303cb7248917524459fab22a29c6877ddaca68b"}],"database_specific":{"source":["AFFECTED_FIELD","DESCRIPTION"],"extracted_events":[{"introduced":"0"},{"fixed":"25.9.2"}]}}],"versions":["v25.9.1","v25.9.0","v25.8.7","v25.8.6","v25.8.5","v25.8.4","v25.8.3","v25.8.2","v25.8.1","v25.8.0","v25.7.1","v25.7.0","v25.6.9","v25.6.7","v25.6.6","v25.6.5","v25.6.4","v25.6.3","v25.6.2","v25.6.1","v25.6.0","v25.5.5","v25.5.4","v25.5.3","v25.5.2","v25.5.1","v25.5.0","v25.4.0","v25.3.2","v25.3.1","v25.2.90","v25.2.89","v25.2.88","v25.2.87","v25.2.86","v25.2.85","v25.2.84","v25.2.82","v25.2.81","v25.2.80","v25.2.79","v25.2.78","v25.2.77","v25.2.76","v25.2.75","v25.2.74","v25.2.73","v25.2.72","v25.2.71","v25.2.70","v25.2.69","v25.2.68","v25.2.67","v25.2.66","v25.2.65","v25.2.63","v25.2.62","v25.2.61","v25.2.60","v25.2.59","v25.2.58","v25.2.57","v25.2.56","v25.2.55","v25.2.53","v25.2.52","v25.2.51","v25.2.50","v25.2.49","v25.2.48","v25.2.47","v25.2.46","v25.2.45","v25.2.44","v25.2.43","v25.2.42","v25.2.41","arm-tools-v1","v25.2.40","v25.2.39","v25.2.38","v25.2.37","v25.2.36","v25.2.35","v25.2.34","v25.2.33","v25.2.32","v25.2.31","v25.2.29","v25.2.28","v25.2.27","v25.2.26","v25.2.25","v25.2.23","v25.2.22","v25.2.21","v25.2.20","v25.2.19","v25.2.18","v25.2.17","v25.2.16","v25.2.15","v25.2.14","v25.2.13","v25.2.12","v25.2.11","v25.2.10","v25.2.9","unraid-tools-v1","v25.2.8","v25.2.7","v25.2.6","v25.2.5","v25.2.4","v25.2.3","v25.2.2","v25.2.1","v25.2.0","v25.1.47","v25.1.46","v25.1.45","v25.1.44","v25.1.43","v25.1.42","v25.1.37","v25.1.36","v25.1.35","v25.1.34","v25.1.32","v25.1.31","v25.1.30","v25.1.29","v25.1.28","v25.1.27","v25.1.26","v25.1.25","v25.1.24","v25.1.23","v25.1.22","v25.1.21","v25.1.20","v25.1.19","v25.1.18","v25.1.17","v25.1.16","v25.1.15","v25.1.14","v25.1.13","v25.1.12","v25.1.11","v25.1.10","v25.1.8","v25.1.7","v25.1.6","v25.1.5","v25.1.4","v25.1.3","v25.1.2","v25.1.1","v25.1.0","v25.0.3","v25.0.2","v25.0.1","v25.0.0","v24.57.36","v24.57.35","v24.57.34","v24.57.33","v24.57.32","v24.57.31","v24.57.30","v24.57.29","v24.57.27","v24.57.26","v24.57.22","v24.57.20","v24.57.19","v24.57.18","v24.57.17","v24.57.16","v24.57.15","v24.57.14","v24.57.13","v24.57.12","v24.57.11","v24.57.10","v24.57.9","v24.57.8","v24.57.7","v24.57.6","v24.57.5","v24.57.4","v24.57.3","v24.57.2","v24.57.1","v24.57.0","v24.56.4","v24.56.3","v24.56.2","v24.56.1","v24.56.0","v24.55.15","v24.55.13","v24.55.10","v24.55.8","v24.55.7","v24.55.6","v24.55.4","v24.55.3","v24.55.2","v24.55.1","v24.55.0","v24.54.0","v24.53.1","v24.53.0","v24.52.0","v24.51.5","v24.51.4","v24.51.3","v24.51.2","v24.51.0","v24.50.4","v24.50.3","v24.50.2","v24.50.1","v24.50.0","v24.49.2","v24.49.1","v24.49.0","v24.48.3","v24.48.2","v24.48.1","v24.48.0","v24.47.2","v24.47.1","v24.47.0","v24.46.4","v24.46.3","v24.46.2","v24.46.1","v24.46.0","v24.45.2","v24.45.1","v24.45.0","v24.44.0","v24.43.3","v24.43.2","v24.43.1","v24.43.0","v24.42.0","v24.41.0","v24.40.0","v24.39.2","v24.39.1","v24.39.0","v24.38.6","v24.38.5","v24.38.4","v24.38.3","v24.38.2","v24.38.1","v24.38.0","v24.37.9","v24.37.8","v24.37.7","v24.37.6","v24.37.5","v24.37.4","v24.37.3","v24.37.1","v24.37.0","v24.36.0","v24.35.0","v24.34.2","v24.34.1","v24.33.0","v24.32.1","v24.32.0","v24.31.1","v24.31.0","v24.30.4","v24.30.3","v24.30.2","v24.29.3","v24.29.2","v24.29.1","v24.29.0","v24.28.0","v24.27.0","v24.26.1","v24.26.0","v24.25.0","v24.24.0","v24.23.8","v24.23.7","v24.23.6","v24.23.5","v24.23.4","v24.23.3","v24.23.2","v24.23.1","v24.23.0","v24.22.1","v24.22.0","v24.21.1","v24.21.0","v24.20.0","v24.19.0","v24.18.0","v24.17.0","v24.16.0","v24.15.3","v24.15.2","v24.15.1","v24.15.0","v24.14.1","v24.14.0","v24.13.1","v24.13.0","v24.12.14","v24.12.13","v24.12.12","v24.12.11","v24.12.10","v24.12.9","v24.12.8","v24.12.7","v24.12.6","v24.12.5","v24.12.4","v24.12.3","v24.12.2","v24.12.1","v24.12.0","v24.11.0","v24.10.1","v24.10.0","v24.9.0","v24.8.1","v24.8.0","v24.7.37","v24.7.36","v24.7.35","v24.7.34","v24.7.33","v24.7.32","v24.7.31","v24.7.30","v24.7.29","v24.7.28","v24.7.27","v24.7.26","v24.7.25","v24.7.24","v24.7.23","v24.7.22","v24.7.21","v24.7.19","v24.7.18","v24.7.17","v24.7.16","v24.7.13","v24.7.12","v24.7.11","v24.7.10","v24.7.9","v24.7.8","v24.7.7","v24.7.6","v24.7.5","v24.7.4","v24.7.3","v24.7.2","v24.7.1","v24.7.0","v24.6.1","v24.6.0","v24.5.0","v24.3.16","v24.3.15","v24.3.14","v24.3.13","v24.3.12","v24.3.11","v24.3.10","v24.3.9","v24.3.8","v24.3.7","v24.3.6","v24.3.5","v24.3.4","v24.3.3","v24.3.2","v24.3.1","v24.3.0","v24.2.0","v24.1.1","v24.1.0","v24.0.2","v24.0.1","v24.0.0","v23.12.19","v23.12.18","v23.12.17","v23.12.16","v23.12.15","v23.12.14","v23.12.13","v23.12.12","v23.12.11","v23.12.10","v23.12.9","v23.12.8","v23.12.7","v23.12.6","v23.12.5","v23.12.4","v23.12.3","v23.12.2","v23.12.1","v23.12.0","v23.11.2","v23.11.1","v23.11.0","v23.10.8","v23.10.7","v23.10.6","v23.10.5","v23.10.4","v23.10.3","v23.10.2","v23.10.1","v23.10.0","v23.9.0","v23.8.0","v23.7.0","v23.6.2","v23.6.1","v23.6.0","v23.5.3","v23.5.2","v23.5.1","v23.4.1","v23.4.0","v23.3.2","v23.3.1","v23.2.3","v23.2.2","v23.2.1","v23.2.0","v23.1.2","v23.1.1","v23.1.0","v23.0.1","v23.0.0","v22.14.13","v22.14.12","v22.14.11","v22.14.10","v22.14.9","v22.14.8","v22.14.7","v22.14.6","v22.14.5","v22.14.4","v22.14.3","v22.14.2","v22.14.1","v22.14.0","v22.13.0","v22.12.0","v22.11.0","v22.10.6","v22.10.5","v22.10.4","v22.10.3","v22.10.2","v22.10.1","v22.10.0","v22.9.48","v22.9.47","v22.9.46","v22.9.45","v22.9.44","v22.9.43","v22.9.42","v22.9.41","v22.9.40","v22.9.39","v22.9.38","v22.9.37","v22.9.36","v22.9.35","v22.9.34","v22.9.33","v22.9.32","v22.9.31","v22.9.30","v22.9.29","v22.9.28","v22.9.27","v22.9.26","v22.9.25","v22.9.24","v22.9.23","v22.9.22","v22.9.21","v22.9.20","v22.9.19","v22.9.18","v22.9.17","v22.9.16","v22.9.15","v22.9.14","v22.9.13","v22.9.12","v22.9.11","v22.9.10","v22.9.9","v22.9.8","v22.9.7","v22.9.6","v22.9.5","v22.9.4","v22.9.3","v22.9.1","v22.9.0","v22.8.3","v22.8.2","v22.8.1","v22.8.0","v22.7.3","v22.7.2","v22.7.1","v22.7.0","v22.6.15","v22.6.14","v22.6.13","v22.6.12","v22.6.11","v22.6.10","v22.6.9","v22.6.8","v22.6.7","v22.6.6","v22.6.5","v22.6.4","v22.6.3","v22.6.2","v22.6.1","v22.6.0","v22.5.9","v22.5.8","v22.5.7","v22.5.6","v22.5.5","v22.5.4","v22.5.3","v22.5.2","v22.5.1","v22.5.0","v22.4.0","v22.3.1","v22.3.0","v22.2.0","v22.1.0","v22.0.2","v22.0.1","v22.0.0","v20.11.12","v20.11.11","v20.11.9","v20.11.10","v20.11.8","v20.11.7","v20.11.6","v20.11.5","v20.11.4","v20.11.3","v20.11.2","v20.11.1","v20.11.0","v20.10.1","v20.10.0","v20.9.9","v20.9.8","v20.9.7","v20.9.6","v20.9.5","v20.9.4","v20.9.3","v20.9.2","v20.9.1","v20.9.0","v20.8.2","v20.8.1","v20.8.0","v20.7.2","v20.7.1","v20.7.0","v20.6.3","v20.6.2","v20.6.1","v20.6.0","v20.5.2","v20.5.4","v20.5.1","v20.5.0","v20.4.8","v20.4.7","v20.4.6","v20.4.5","v20.4.4","v20.4.3","v20.4.2","v20.4.1","v20.4.0","v20.3.3","v20.3.2","v20.3.1","v20.3.0","v20.2.0","v20.1.0","v20.0.3","v20.0.2","v20.0.1","v20.0.0","v19.9.2","v19.9.1","v19.9.0","v19.8.1","v19.8.0","v19.7.4","v19.7.3","v19.7.2","v19.7.1","v19.7.0","v19.6.2","v19.6.1","v19.6.0","v19.5.0","v19.4.0","v19.3.0","v19.2.2","v19.2.1","v19.2.0","v19.1.0","v19.0.5","v19.0.4","v19.0.3","v19.0.2","v19.0.1","v19.0.0","v18.7.39","v18.7.38","v18.7.37","v18.7.36","v18.7.35","v18.7.34","v18.7.33","v18.7.32","v18.7.31","v18.7.30","v18.7.29","v18.7.28","v18.7.27","v18.7.26","v18.7.25","v18.7.24","v18.7.23","v18.7.22","v18.7.21","v18.7.20","v18.7.19","v18.7.18","v18.7.17","v18.7.16","v18.7.14","v18.7.13","v18.7.12","v18.7.11","v18.7.9","v18.7.10","v18.7.8","v18.7.7","v18.7.6","v18.7.5","v18.7.4","v18.7.3","v18.7.2","v18.7.0","v18.6.1","v18.6.0","v18.5.0","v18.4.0","v18.3.1","v18.3.0","v18.2.1","v18.2.0","v18.1.1","v18.1.0","v18.0.2","v18.0.1","v18.0.0","v17.4.30","v17.4.29","v17.4.28","v17.4.27","v17.4.26","v17.4.25","v17.4.24","v17.4.23","v17.4.22","v17.4.21","v17.4.20","v17.4.19","v17.4.18","v17.4.17","v17.4.16","v17.4.15","v17.4.14","v17.4.13","v17.4.12","v17.4.11","v17.4.10","v17.4.9","v17.4.8","v17.4.7","v17.4.6","v17.4.5","v17.4.4","v17.4.3","v17.4.2","v17.4.1","v17.4.0","v17.3.5","v17.3.4","v17.3.3","v17.3.2","v17.3.1","v17.3.0","v17.2.3","v17.2.2","v17.2.1","v17.2.0","v17.1.15","v17.1.14","v17.1.13","v17.1.12","v17.1.11","v17.1.10","v17.1.9","v17.1.8","v17.1.7","v17.1.6","v17.1.5","v17.1.4","v17.1.3","v17.1.2","v17.1.1","v17.1.0","v17.0.14","v17.0.13","v17.0.12","v17.0.10","v17.0.8","v17.0.7","v17.0.6","v17.0.5","v17.0.1","v17.0.0","v16.42.2","v16.42.1","v16.42.0","v16.41.0","v16.39.0","v16.38.0","v16.37.0","v16.36.0","v16.35.2","v16.35.1","v16.35.0","v16.34.0","v16.33.3","v16.33.2","v16.33.1","v16.33.0","v16.32.1","v16.32.0","v16.31.2","v16.31.1","v16.31.0","v16.30.1","v16.30.0","v16.29.0","v16.28.0","v16.27.1","v16.27.0","v16.26.0","v16.25.1","v16.25.0","v16.24.0","v16.23.1","v16.23.0","v16.22.0","v16.21.7","v16.21.6","v16.21.5","v16.21.4","v16.21.3","v16.21.2","v16.21.1","v16.21.0","v16.20.0","v16.18.0","v16.17.1","v16.17.0","v16.16.9","v16.16.8","v16.16.7","plugins","v16.16.6","v16.16.5","v16.16.4","v16.16.3","v16.16.2","v16.16.1","v16.16.0","v16.15.1","v16.15.0","v16.14.1","v16.14.0","v16.13.0","v16.12.0","v16.11.3","v16.11.1","v16.11.0","v16.10.3","v16.10.2","v16.10.1","v16.10.0","v16.9.4","v16.9.3","v16.9.2","v16.9.1","v16.9.0","v16.8.5","v16.8.4","v16.8.3","v16.8.2","v16.8.1","v16.8.0","v16.7.4","v16.7.3","v16.7.2","v16.7.1","v16.7.0","v16.6.0","v16.5.3","v16.5.2","v16.5.1","v16.5.0","v16.4.0","v16.3.2","v16.3.1","v16.3.0","v16.2.1","v16.2.0","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73519.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}