Zero Radar
← feed
CriticalVulnerabilityCVE-2026-59106updated 26 Oct 2026, 16:57 UTC

WolfProt interface lets unauthenticated attackers run OS commands

Attackers on the network can send specially crafted input to a WolfProt service without logging in and make the server run commands of their choosing. This can give them control over the machine running the service.

Official, 2 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Unauthenticated attackerNo login or credentials needed
  2. 2Reaches WolfProt serviceService accessible over the network
  3. 3Malicious input sentInput is not properly sanitized
  4. 4OS command executedRuns with the service's privileges
  5. ResultAttacker controls the server

What happened

A command injection flaw (CWE-78 class: user-controlled input not neutralized) exists in the WolfProt interface implementation, letting unauthenticated network attackers execute OS commands with the privileges of the affected application service.

Why it is dangerous: An attacker can take over the server hosting the vulnerable service without any credentials, and could then read or change its data and use it as a foothold in the wider network.

Are you affected?

You are affected if you run a WolfProt interface implementation exposed to the network in a version the advisories list as vulnerable.

WolfProt interface implementation (exact versions not stated in the provided material)

What to do

  1. Check whether your systems run the WolfProt interface and which version it is
  2. Restrict network access to the WolfProt service so only trusted hosts can reach it
  3. Watch the official GitHub advisory GHSA-rwp5-547m-r274 for a patched version and update as soon as one is published

Timeline

  1. 26 Oct 2026, 14:16 UTC
    Publicly disclosed
  2. 26 Oct 2026, 14:16 UTC
    Reported by NVD · NVD
  3. 26 Oct 2026, 14:21 UTC
    Picked up by Zero Radar
  4. 26 Oct 2026, 16:57 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-59106 · GHSA-rwp5-547m-r274
CVSS
9.3 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
26 Oct 2026, 14:16 UTC
On Zero Radar
26 Oct 2026, 14:21 UTC (4 min after disclosure)
Last change
26 Oct 2026, 16:57 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

WolfProt interface lets unauthenticated attackers run OS commands · Zero Radar