CVE-2026-73519: WolfStack Hard-Coded Auth Secret — Detection and Remediation Guide

NVD has published CVE-2026-73519, a CVSS 9.8 (Critical) vulnerability in WolfStack, a widely deployed container-host management platform. The flaw is about as bad as it gets from a defender's perspective: a hard-coded cluster-authentication secret is compiled into every build of WolfStack and published as a constant in src/auth/mod.rs. Because the value is identical across all installations of affected versions, any attacker who reads the source (or reverse-engineers the binary) can present that secret to the require_auth() gate via the X-WolfStack-Secret HTTP header and walk straight through authentication — no session, no API key, no user account, no brute force required.

What an attacker gets post-bypass is the real problem. Reaching an affected node's management port, an unauthenticated remote attacker can:

• Enumerate every Docker and LXC container on the host
• Execute arbitrary commands as root inside any container via POST /api/containers/{runtime}/{id}/exec

Container escape considerations aside, root inside an arbitrary container on a production host typically means access to mounted secrets, application data, internal network segments, and in many deployments (privileged containers, hostPath mounts, shared PID/net namespaces) a direct path to host compromise. If you run WolfStack on anything that touches production, treat this as an emergency patch cycle.

Technical Analysis

Affected Products and Versions

Root Cause and Exploitation Mechanics

This is a classic CWE-798 (Use of Hard-coded Credentials) failure with maximum blast radius:

1. The secret is a compile-time constant. Every build of WolfStack prior to 25.9.2 embeds the same cluster-authentication secret, declared as a constant in src/auth/mod.rs. Because WolfStack's source (or at minimum the distributed binaries) is obtainable by anyone, the secret is effectively public knowledge.

2. The require_auth() gate trusts the header unconditionally. The middleware checks for the X-WolfStack-Secret header and, if the presented value matches the embedded constant, grants access — bypassing all session validation, API key checks, and user account verification.

3. The management API exposes high-privilege functionality. Once past the gate, the attacker can call the container enumeration endpoints and then POST /api/containers/{runtime}/{id}/exec to run arbitrary commands as root inside any Docker or LXC container on the node.

The exploitation chain from a network position is trivial:

• Identify an exposed WolfStack management port (banner grab, service fingerprint, or simple HTTP probing of the API path structure)
• Send any API request with X-WolfStack-Secret: <published constant>
• Enumerate containers (runtime values such as docker or lxc, with container IDs returned by the enumeration call)
• POST to the exec endpoint with an arbitrary command — it executes as root in the target container's namespace

No race conditions, no memory corruption, no authentication throttling to defeat. The only thing standing between an attacker and root-in-container execution is network reachability to the management port.

Exploitation Status

At the time of this writing, CVE-2026-73519 has been published by NVD with full technical detail — including the exact header name, the source file containing the constant, and the vulnerable endpoint path. That level of disclosure means functional exploit material is trivial to produce; a working exploit is essentially a two-line HTTP request. Defenders should assume scanning and opportunistic exploitation are imminent or already underway, particularly against internet-exposed management interfaces. The vulnerability is network-exploitable, unauthenticated, and affects a widely deployed component — this is exactly the profile that gets folded into mass-scanning tooling within days of disclosure. Check CISA KEV status and the NVD entry for updates on confirmed in-the-wild activity.

Why This Is Worse Than a Typical Auth Bypass

• No per-deployment entropy. Credential rotation does nothing — the secret is identical everywhere and cannot be changed by configuration on affected versions.
• Cluster-wide trust. The secret gates cluster authentication, so one exposed node can potentially be leveraged against its peers.
• Root in any container. The exec endpoint doesn't restrict which containers can be targeted — every Docker and LXC workload on the node is fair game.

Detection & Response

The good news: exploitation of this vulnerability is loud and highly specific if you're looking at HTTP traffic to the management interface. The attack has a unique fingerprint — the X-WolfStack-Secret header itself. Since legitimate clients authenticate via sessions or API keys in normal workflows (the header is the cluster-internal path), external or unexpected use of this header is a high-fidelity signal.

Sigma Rules

The rules below target (1) HTTP requests carrying the telltale header and hitting the WolfStack API, and (2) the exec endpoint being invoked — the post-exploitation action. The header-based rule is the highest-fidelity signal; the exec-endpoint rule catches attackers who may have obtained legitimate session material as well. Deploy these against reverse-proxy, WAF, load balancer, or WolfStack access logs ingested into your SIEM.

---
title: WolfStack CVE-2026-73519 Hard-Coded Secret Header Observed
id: 3f9a1c74-2b6d-4e58-9a31-7c0d5e8f2b14
status: experimental
description: Detects HTTP requests to the WolfStack management API containing the X-WolfStack-Secret header, the abuse path for CVE-2026-73519 hard-coded cluster secret authentication bypass. In most environments this header should only appear in internal cluster node-to-node traffic.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73519
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1078
  - attack.t1190
logsource:
  category: webserver
  product: linux
detection:
  selection_header:
    http_request_headers|contains: 'X-WolfStack-Secret'
  selection_path:
    http_request_uri|contains:
      - '/api/containers'
      - '/api/cluster'
      - '/api/nodes'
  condition: selection_header and selection_path
falsepositives:
  - Legitimate WolfStack cluster node-to-node communication (filter by known cluster node source IPs)
  - Internal health checks that use the cluster secret path
level: high
---
title: WolfStack Container Exec Endpoint Invoked
id: 8c2e5b19-4d7a-4f31-b6c2-9e1a3d7f5c08
status: experimental
description: Detects POST requests to the WolfStack container exec API endpoint (/api/containers/{runtime}/{id}/exec), which CVE-2026-73519 attackers use to execute arbitrary commands as root inside Docker or LXC containers after bypassing authentication.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73519
  - https://attack.mitre.org/techniques/T1609/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1609
logsource:
  category: webserver
  product: linux
detection:
  selection_method:
    http_method: 'POST'
  selection_uri:
    http_request_uri|contains:
      - '/api/containers/docker/'
      - '/api/containers/lxc/'
  selection_exec:
    http_request_uri|endswith: '/exec'
  condition: selection_method and selection_uri and selection_exec
falsepositives:
  - Legitimate administrative container exec operations via the WolfStack UI or API (correlate with authenticated admin sessions and known admin source IPs)
level: medium

Tuning guidance: The first rule will fire on legitimate cluster traffic if nodes talk to each other over the monitored interface. Baseline your cluster node IPs and suppress them — but only after confirming the source is a genuine cluster peer, because a compromised peer is a realistic lateral-movement source. The second rule is noisier in environments where admins routinely exec into containers, so pair it with source-IP and authentication-context enrichment.

KQL — Microsoft Sentinel / Defender

This hunt assumes WolfStack access logs, reverse-proxy logs, or firewall data are ingested into Sentinel via Syslog/CEF (Syslog, CommonSecurityLog) or a custom table. It looks for the telltale header and the exec endpoint pattern. Even though WolfStack is a Linux-side service, Sentinel hunting applies if you forward proxy/WAF/syslog telemetry.

// Hunt for CVE-2026-73519 exploitation: X-WolfStack-Secret header and exec endpoint abuse
// Adjust table/field names to your ingestion (CEF via CommonSecurityLog, raw Syslog, or custom CL)
let lookback = 14d;
union isfuzzy=true
    (Syslog
     | where TimeGenerated > ago(lookback)
     | where SyslogMessage has "X-WolfStack-Secret"
        or SyslogMessage has "/api/containers/"
     | project TimeGenerated, Computer, SourceIP=HostIP, SyslogMessage
     | extend Indicator = iff(SyslogMessage has "X-WolfStack-Secret", "Hardcoded Secret Header", "Container API Access")),
    (CommonSecurityLog
     | where TimeGenerated > ago(lookback)
     | where RequestURL has "/api/containers/" and RequestURL endswith "/exec"
        or AdditionalExtensions has "X-WolfStack-Secret"
     | project TimeGenerated, SourceIP, RequestURL, RequestMethod, AdditionalExtensions
     | extend Indicator = "Exec Endpoint or Secret Header")
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Hits=count(), DistinctSources=dcount(SourceIP)
  by SourceIP, Indicator
| order by Hits desc

Follow-up pivot: once you identify a suspicious source IP, pull the full request history for that source to reconstruct enumeration activity (GET requests listing containers) preceding any exec calls — enumeration-then-exec sequencing strongly suggests exploitation rather than admin activity.

Velociraptor VQL

On WolfStack nodes themselves, hunt for evidence of root command execution inside containers that didn't originate from legitimate admin tooling — and inspect listening exposure of the management port. This artifact examines process execution on the host for container runtime exec activity correlated with unusual parentage.

-- CVE-2026-73519: Hunt for suspicious container exec activity on WolfStack nodes
-- Looks for docker/lxc exec invocations and WolfStack management port exposure
LET procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(docker exec|lxc-exec|lxc-attach|nsenter)'
   OR Name =~ '(docker|lxc|nsenter)'

LET listeners = SELECT Pid, Name, Laddr, Lport, Status
FROM netstat()
WHERE Status =~ 'LISTEN'

SELECT 'exec_activity' AS ArtifactSection, Pid, Ppid, Name, CommandLine, Username, CreateTime,
       '' AS Laddr, '' AS Lport
FROM procs
UNION ALL
SELECT 'management_listener' AS ArtifactSection, Pid, '' AS Ppid, Name, '' AS CommandLine,
       '' AS Username, NULL AS CreateTime, Laddr, Lport
FROM listeners
WHERE Name =~ '(wolfstack|wolf)' OR Lport IN (8080, 8443, 9000)

Analyst note: docker exec / lxc-attach from an interactive admin shell is normal; the same commands with a parent process of the WolfStack service itself (or a web worker) executed at times matching suspicious HTTP requests are a strong compromise indicator. The listener check identifies whether the management port is bound to 0.0.0.0/public interfaces — an exposure issue you should fix regardless of patching.

Remediation & Verification Script

Use the following Bash script to (1) confirm the installed WolfStack version, (2) check whether the management interface is exposed beyond localhost/trusted interfaces, (3) hunt access logs for exploitation indicators, and (4) apply compensating firewall controls pending the 25.9.2 upgrade.

#!/usr/bin/env bash
# CVE-2026-73519 WolfStack verification & compensating-control script
# Run as root on each WolfStack node. Test in staging before production use.

set -euo pipefail

MGMT_PORT="${WOLFSTACK_MGMT_PORT:-8080}"   # adjust to your deployment
LOG_PATH="${WOLFSTACK_LOG:-/var/log/wolfstack/access.log}"
ALLOWED_NET="192.168.10.0/24"             # adjust: your trusted management/cluster CIDR

echo "=== [1] WolfStack version check ==="
if command -v wolfstack >/dev/null 2>&1; then
  wolfstack --version || true
else
  dpkg -l 2>/dev/null | grep -i wolfstack || rpm -qa 2>/dev/null | grep -i wolfstack || echo "WolfStack binary/package not found in PATH"
fi
echo "REQUIRED: version >= 25.9.2. Anything older is VULNERABLE to CVE-2026-73519."

echo ""
echo "=== [2] Management port exposure check ==="
ss -tlnp 2>/dev/null | grep -E ":${MGMT_PORT}\b" || echo "Management port ${MGMT_PORT} not listening"
echo "If bound to 0.0.0.0 or a public interface, restrict immediately (see step 4)."

echo ""
echo "=== [3] Exploitation indicator sweep (last 7 days of logs) ==="
if [ -f "$LOG_PATH" ]; then
  echo "--- Requests carrying X-WolfStack-Secret header ---"
  grep -i "X-WolfStack-Secret" "$LOG_PATH"* 2>/dev/null | tail -n 50 || echo "None found in ${LOG_PATH}"
  echo "--- POSTs to container exec endpoint ---"
  grep -E "POST /api/containers/(docker|lxc)/[^ ]+/exec" "$LOG_PATH"* 2>/dev/null | tail -n 50 || echo "None found"
else
  echo "Log path ${LOG_PATH} not found — check your WolfStack/reverse-proxy log location"
fi
journalctl -u wolfstack --since "7 days ago" 2>/dev/null | grep -iE "exec|secret" | tail -n 50 || true

echo ""
echo "=== [4] Compensating control: restrict management port to trusted CIDR ==="
echo "Applying iptables rule: allow ${ALLOWED_NET} -> tcp/${MGMT_PORT}, drop all others"
iptables -C INPUT -p tcp --dport "$MGMT_PORT" -s "$ALLOWED_NET" -j ACCEPT 2>/dev/null \
  || iptables -I INPUT -p tcp --dport "$MGMT_PORT" -s "$ALLOWED_NET" -j ACCEPT
iptables -C INPUT -p tcp --dport "$MGMT_PORT" -j DROP 2>/dev/null \
  || iptables -I INPUT -p tcp --dport "$MGMT_PORT" -j DROP
echo "NOTE: persist these rules per your distro (iptables-save / nftables / firewalld)."

echo ""
echo "=== [5] Upgrade reminder ==="
echo "Firewall rules are a stopgap ONLY. Upgrade to WolfStack 25.9.2 immediately:"
echo "  https://nvd.nist.gov/vuln/detail/CVE-2026-73519"
echo "After upgrade, re-run this script and confirm version >= 25.9.2."

Remediation

Primary action — patch immediately:

1. Upgrade all WolfStack nodes to version 25.9.2 or later. The fix removes the hard-coded secret from the authentication path. Patching is the only complete remediation — the vulnerable constant cannot be rotated or disabled by configuration on affected versions.
2. Verify the upgrade took effect on every node (cluster peers included) and confirm no node reports a pre-25.9.2 version.

Compensating controls (deploy while patching, keep as defense-in-depth after):

• Restrict network reachability to the management port. It should never be internet-facing. Bind it to localhost or a dedicated management interface and enforce allowlists at the firewall/security-group layer permitting only cluster peers and admin jump hosts (see script step 4).
• Place the management API behind an authenticating reverse proxy or mTLS gateway if it must be reachable across network segments — an external auth layer blunts the bypass even on unpatched nodes.
• Segment container hosts so that compromise of one node's management plane cannot reach peer nodes or container workload networks.

Post-patch forensics — assume breach and look back:

• Review management API access logs for the past 30+ days for X-WolfStack-Secret header usage from non-cluster IPs and for POST .../exec calls to containers. Any hit from an unrecognized source = treat the node and affected containers as compromised.
• If suspicious exec activity is found, rotate every secret accessible from affected containers (mounted credentials, API tokens, cloud instance metadata credentials, TLS keys), inspect containers for persistence (unexpected processes, modified binaries, new cron/systemd units, added SSH keys), and consider rebuilding containers from known-good images.
• Rotate any legitimate cluster credentials and API keys as well — an attacker with pre-patch access may have harvested them.

Governance items:

• Track remediation in your vulnerability management program with emergency-change priority — a 9.8 network-exploitable unauthenticated auth bypass with trivial exploitation meets every definition of an emergency patch.
• Monitor the NVD entry and CISA KEV for exploitation-status updates and any mandated remediation deadlines.
• Feed the Sigma rules and KQL above into your detection stack before you finish patching — the detection window matters most during the patch gap.

Key Takeaways

• Hard-coded secrets in compiled artifacts are unrotatable. If the secret ships in the binary, it is public. Any product with this pattern deserves architectural scrutiny and compensating network controls at minimum.
• Management planes are crown-jewel attack surface. Container orchestration and host management APIs should never be broadly reachable — segment, allowlist, and proxy-authenticate them as standard practice, not as an incident response measure.
• The header itself is your highest-fidelity IOC. X-WolfStack-Secret appearing in requests from non-cluster sources is a near-unambiguous exploitation signal. Get that detection live today.
• Patching closes the door; it doesn't tell you who came through it. Pair every emergency patch with retrospective log review scoped to the vulnerability's specific exploitation artifacts.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub