Cobbler versions 3.0.0 through before 3.2.3 and 3.3.0 through before 3.3.7 contain a vulnerability where the shared secret retrieval function always returns -1 due to a coding error. This allows anyone with network access to connect to the Cobbler XML-RPC server using a known password (-1) and an empty username, granting full control over the server.