CVE-2026-73519 describes a critical vulnerability in WolfStack before version 25.9.2 where a hard-coded cluster-authentication secret is compiled into every build and exposed as a constant in the source code. Attackers can use this secret by supplying it in the X-WolfStack-Secret HTTP header to bypass authentication checks without requiring any session, API key, or user account. Once authenticated this way, attackers can access the management port of an affected node to enumerate all Docker and LXC containers on the host and execute arbitrary commands with root privileges inside any container through the POST /api/containers/{runtime}/{id}/exec endpoint.

This vulnerability allows unauthenticated remote attackers to fully bypass authentication and gain root command execution inside containers managed by WolfStack. This can lead to complete compromise of containerized environments on the affected host, including unauthorized access, data manipulation, and potential lateral movement within the infrastructure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the management port of WolfStack nodes to trusted administrators only and monitor for unauthorized use of the X-WolfStack-Secret header. Avoid exposing the management interface to untrusted networks.