Wolfstack
Monthly
Remote unauthenticated authentication bypass in WolfStack before 25.9.2 lets attackers fully compromise container hosts by supplying a hard-coded cluster secret in the X-WolfStack-Secret header. Because the secret is a compile-time constant published in src/auth/mod.rs, anyone who can reach a node's management port passes the require_auth() gate with no session, API key, or account, and can then enumerate every Docker/LXC container and run arbitrary commands as root inside any of them. No public exploit is identified at time of analysis, but the flaw is trivially reproducible from source and was reported by VulnCheck.
Remote unauthenticated authentication bypass in WolfStack before 25.9.2 lets attackers fully compromise container hosts by supplying a hard-coded cluster secret in the X-WolfStack-Secret header. Because the secret is a compile-time constant published in src/auth/mod.rs, anyone who can reach a node's management port passes the require_auth() gate with no session, API key, or account, and can then enumerate every Docker/LXC container and run arbitrary commands as root inside any of them. No public exploit is identified at time of analysis, but the flaw is trivially reproducible from source and was reported by VulnCheck.