Which versions of WolfStack are affected by EUVD-2026-57638?

WolfStack container management platform contains a critical authentication bypass exposing organizations to complete loss of control over all containerized applications and infrastructure.. A patch is available.

How to fix or mitigate EUVD-2026-57638?

Within 24 hours: Restrict all network access to WolfStack management ports to a small set of trusted administrative jump hosts via firewall rules, disable remote access to management ports if operationally feasible, and enable comprehensive logging of all management port connection attempts. Within 7 days: Conduct forensic log analysis covering the past 60 days to identify unauthorized attempts to access management ports or execute container commands, audit all deployed containers for signs of compromise, and document the WolfStack version across all infrastructure. Within 30 days: Monitor vendor security advisories daily for patch availability and immediately prepare a validated upgrade plan; evaluate architectural mitigations such as network segmentation or running WolfStack only on isolated administrative networks, and establish an emergency deployment procedure for when a patch becomes available.

WolfStack EUVD-2026-57638

Q: What is the CVSS score of EUVD-2026-57638?

EUVD-2026-57638 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

| CVE-2026-73519 CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-08-12 VulnCheck

GHSA-pm35-p792-8vr3

Authentication Bypass Docker Wolfstack

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Remote, unauthenticated, low-complexity header bypass yields root command execution inside containers, and escaping the management app to control container workloads justifies S:C with full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 12, 2026 - 22:03 EUVD

Analysis Generated

Aug 12, 2026 - 21:51 vuln.today

CVE Published

Aug 12, 2026 - 21:15 cve.org

CRITICAL 9.3

DescriptionCVE.org

WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the require_auth() gate without any session, API key, or user account. Attackers can reach an affected node's management port to enumerate all Docker and LXC containers on the host and execute arbitrary commands as root inside any container via the POST /api/containers/{runtime}/{id}/exec endpoint.

Articles & Coverage 2

News 3 New Docker Vulnerabilities - 1 Critical, 2 High, 2 With POC Aug 13, 2026 News Critical Authentication Bypass in WolfStack Docker - CVE-2026-73519 Aug 12, 2026

AnalysisAI

Remote unauthenticated authentication bypass in WolfStack before 25.9.2 lets attackers fully compromise container hosts by supplying a hard-coded cluster secret in the X-WolfStack-Secret header. Because the secret is a compile-time constant published in src/auth/mod.rs, anyone who can reach a node's management port passes the require_auth() gate with no session, API key, or account, and can then enumerate every Docker/LXC container and run arbitrary commands as root inside any of them. No public exploit is identified at time of analysis, but the flaw is trivially reproducible from source and was reported by VulnCheck.

Technical ContextAI

WolfStack is a Rust-based container/cluster management platform (Wolf Software Systems Ltd) that orchestrates Docker and LXC workloads and exposes a management API. The root cause is CWE-798 (Use of Hard-coded Credentials): the cluster-authentication secret is baked into every build as a constant in src/auth/mod.rs rather than being generated per-deployment or stored as configuration. The require_auth() middleware validates inbound requests by comparing the X-WolfStack-Secret header against this constant, so the shared secret is identical across all installations and is recoverable simply by reading the open-source repository or disassembling a binary. The affected component is the management API, notably the POST /api/containers/{runtime}/{id}/exec endpoint, which brokers command execution into container runtimes with root privileges.

RemediationAI

Upgrade to WolfStack 25.9.2 or later, which removes the hard-coded secret; this is the primary and complete fix (Vendor-released patch: 25.9.2). Follow the vendor advisory GHSA-r3mw-2wmq-j6jg and the VulnCheck advisory for details. Until you can patch, restrict network access to the management port so it is only reachable from trusted management networks or via VPN/firewall allowlists (accepting that legitimate cluster/administration traffic must be re-scoped to those sources), since the shared secret cannot be rotated or trusted while it remains a compiled constant. Because any node reachable on its management port is exploitable, also review whether nodes have been exposed to untrusted networks and inspect /api/containers/{runtime}/{id}/exec activity and container audit logs for signs of prior abuse.