WolfStack contains a hard‑coded secret that is compiled into the code base and exposed as a constant. Attackers can supply this value in the X‑WolfStack‑Secret header to the require_auth() gate and bypass authentication without the need for a session, API key, or user account. This gives remote unauthenticated users the ability to enumerate all Docker and LXC containers on the host and execute arbitrary commands as root inside any container through the POST /api/containers/{runtime}/{id}/exec endpoint.

The vulnerability impacts wolfsoftwaresystemsltd WolfStack installations running any version earlier than 25.9.2. No specific patch version is listed beyond 25.9.2, so all builds before that release are considered affected.

The score of 9.3 on the CVSS scale places this flaw in the critical severity range. The EPSS score is not available but the nature of the flaw – a hard‑coded secret that can be used from any network connection to the management port – suggests a high likelihood of exploitation in environments where the management port is reachable. It is not currently listed in the CISA Known Exploited Vulnerabilities catalog, but the absence of a KEV listing does not diminish the risk; the flaw is exploitable by any remote actor with network access to the affected port. The attack is remote, requires no prior authentication, and results in full root‑level control inside containers, which in turn can compromise the host or other services. The rapid identification of the flaw and publication of an update underscore the urgency of mitigation.