Dostxodjayev Abdullox

**Name of the Vulnerable Software and Affected Versions** WolfStack versions prior to 25.9.2 **Description** A hard-coded cluster-authentication secret is compiled into every build and published as a constant in src/auth/mod.rs. This allows remote unauthenticated attackers to bypass authentication by providing this secret in the `X-WolfStack-Secret` header to the `require auth()` gate, removing the need for a session, API key, or user account. By accessing the management port, attackers can enumerate all Docker and LXC containers on the host and execute arbitrary commands as root within any container via the 'POST /api/containers/{runtime}/{id}/exec' endpoint. **Recommendations** Update to version 25.9.2 or later.