Hard-coded authentication secret in WolfStack allows unauthenticated remote code execution (CVE-2026-73519)

WolfStack compiled a single hard-coded cluster-authentication secret into every build, published as a constant in src/auth/mod.rs. Any remote unauthenticated attacker able to reach an affected node's management port could bypass authentication by supplying this value in the X-WolfStack-Secret header, gaining the ability to enumerate all Docker and LXC containers on the host and execute arbitrary commands as root inside any container via POST /api/containers/{runtime}/{id}/exec. Affected versions: - <= 25.9.1 We recommend updating to: 25.9.2. CVSS 9.3 · our assessment: act_now Reference: https://github.com/wolfsoftwaresystemsltd/WolfStack/security/advisories/GHSA-r3mw-2wmq-j6jg Details: https://vuln.today/cve/CVE-2026-73519