Get a Demo

Let's Patch It!

Book a short call with one our specialists, we'll walk you through how Endor Patches work, and ask you a few questions about your environment (like your primary programming languages and repository management). We'll also send you an email right after you fill out the form, feel free to reply with any questions you have in advance!

CVE

CVE-2026-26009

Catalyst Affected by Remote Code Execution as Root via Containerized Install Script Execution
Back to all
CVE

CVE-2026-26009

Catalyst Affected by Remote Code Execution as Root via Containerized Install Script Execution

Catalyst is a platform built for enterprise game server hosts, game communities, and billing panel integrations. Install scripts defined in server templates execute directly on the host operating system as root via bash -c, with no sandboxing or containerization. Any user with template.create or template.update permission can define arbitrary shell commands that achieve full root-level remote code execution on every node machine in the cluster. This vulnerability is fixed in commit 11980aaf3f46315b02777f325ba02c56b110165d.

Package Versions Affected

Package Version
patch Availability
No items found.

Automatically patch vulnerabilities without upgrading

Fix Without Upgrading
Detect compatible fix
Apply safe remediation
Fix with a single pull request

CVSS Version

Severity
Base Score
CVSS Version
Score Vector
C
H
U
9.9
-
3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
C
H
U
0
-
3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
C
H
U
-

Related Resources

No items found.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26009.json, https://github.com/karutoil/catalyst/commit/11980aaf3f46315b02777f325ba02c56b110165d, https://github.com/karutoil/catalyst/security/advisories/GHSA-xv5r-cpcw-8wr3, https://nvd.nist.gov/vuln/detail/CVE-2026-26009

Severity

9.9

CVSS Score
0
10

Basic Information

Ecosystem
Base CVSS
9.9
EPSS Probability
0.00291%
EPSS Percentile
0.52114%
Introduced Version
0
Fix Available
11980aaf3f46315b02777f325ba02c56b110165d

Fix Critical Vulnerabilities Instantly

Secure your app without upgrading.
Fix Without Upgrading