PT-2026-7439 · Catalyst · Catalyst

Loopofficial · Published 2026-02-10 · Updated 2026-02-11 · CVE-2026-26009

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Catalyst versions prior to 11980aaf3f46315b02777f325ba02c56b110165d

Description The platform allows users with template.create or template.update permissions to define arbitrary shell commands within server templates. These commands are executed as root via bash -c on the host operating system without any sandboxing or containerization, leading to full root-level remote code execution on every node machine in the cluster. The affected API endpoint is the server template creation/update functionality. The vulnerable variable is the template content itself, which allows for arbitrary shell command injection.

Recommendations Update to version 11980aaf3f46315b02777f325ba02c56b110165d or later. Restrict permissions for template.create and template.update to prevent unauthorized users from defining arbitrary shell commands.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-26009

GHSA-XV5R-CPCW-8WR3

Affected Products

Catalyst

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26009.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-26009 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26009 · Security Note
• https://github.com/karutoil/catalyst/security/advisories/GHSA-xv5r-cpcw-8wr3 · Note
• https://github.com/karutoil/catalyst/commit/11980aaf3f46315b02777f325ba02c56b110165d · Note
• https://twitter.com/offseq/status/2021396368477057084 · Twitter Post
• https://t.me/CVEtracker/44334 · Telegram Post