Vulnonym.com

CVE-2026-26009 - Taloned Slutwear

Description

Catalyst is a platform built for enterprise game server hosts, game communities, and billing panel integrations. Install scripts defined in server templates execute directly on the host operating system as root via bash -c, with no sandboxing or containerization. Any user with template.create or template.update permission can define arbitrary shell commands that achieve full root-level remote code execution on every node machine in the cluster. This vulnerability is fixed in commit 11980aaf3f46315b02777f325ba02c56b110165d.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Reference

https://github.com/karutoil/catalyst/commit/11980aaf3f46315b02777f325ba02c56b110165d https://github.com/karutoil/catalyst/security/advisories/GHSA-xv5r-cpcw-8wr3

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

9.9

Base Severity

CRITICAL

Remediation Step-by-Step Guide

  1. Update to the Patched Version
    Immediately upgrade the Catalyst platform to version containing commit 11980aaf3f46315b02777f325ba02c56b110165d. Verify the version number matches the fixed release in official changelogs or package repositories.

  2. Revoke Template Modification Permissions
    Temporarily revoke template.create and template.update permissions for all non-administrative users. Restrict these privileges to a minimal set of trusted administrators only.

  3. Audit Existing Templates
    Review all existing server templates for malicious or unintended shell commands. Remove or quarantine any template containing direct bash -c execution, especially those referencing root privileges.

  4. Implement Sandbox Execution
    Modify the template execution engine to:
    • Run scripts within a containerized environment (e.g., Docker, Podman) with restricted capabilities.
    • Use non-root user contexts inside containers.
    • Apply mandatory access controls (e.g., AppArmor, SELinux) to limit filesystem and network access.
  5. Enforce Input Validation & Whitelisting
    Implement strict input validation for template content:
    • Only allow predefined, safe command snippets from a whitelist.
    • Reject any input containing shell metacharacters (;, |, &&, $(), etc.) unless explicitly authorized via policy.
  6. Enable Logging and Monitoring
    Log all template creation, modification, and execution events. Integrate with SIEM tools to alert on:
    • Unusual template updates.
    • Execution of high-risk commands (e.g., curl, wget, rm, chmod).
    • Multiple failed template executions.

  7. Conduct Security Testing
    Perform penetration testing and red team exercises to validate the effectiveness of remediation measures. Use tools like Burp Suite or custom scripts to attempt RCE via template injection.

  8. Train Staff
    Educate administrators and developers on secure template design, the risks of root-level execution, and safe deployment practices.

  9. Review and Harden CI/CD Pipelines
    Ensure template modifications are reviewed via pull requests and automatically scanned for security issues before deployment.

Context within ISO/IEC 27001 and NIST Frameworks

ISO/IEC 27001 Controls

  • A.9.4.1 – Access control policy
    Unrestricted template.create and template.update permissions violate the principle of least privilege. Access must be granted based on business need and reviewed regularly.

  • A.12.5.1 – Management of technical vulnerabilities
    Failure to patch or mitigate known critical vulnerabilities (like untrusted code execution) breaches the requirement for timely vulnerability management.

  • A.13.2.4 – Secure development policy
    The lack of sandboxing or containerization reflects a failure in secure software design principles mandated under development security controls.

  • A.14.2.5 – Secure system architecture
    Direct root execution without isolation violates architectural security requirements for separation of duties and defense-in-depth.

NIST SP 800-53 Controls

  • SI-4 (System Monitoring)
    Lack of logging and monitoring for template execution prevents detection of malicious activity. Enhanced logging and anomaly detection are required.

  • SI-10 (Information System Monitoring)
    The system must detect and respond to unauthorized code execution. Current state lacks automated detection mechanisms.

  • SC-7 (Boundary Protection)
    No isolation or containerization between untrusted user input and the host OS violates boundary protection controls.

  • SC-13 (Remote Access)
    Remote execution of arbitrary code with root privileges constitutes an uncontrolled remote access vector requiring explicit authorization and encryption.

  • SA-12 (Security Engineering Principles)
    The design fails to apply secure-by-default principles. Root access and direct shell execution must be avoided in favor of containerized, permission-restricted environments.

  • RA-5 (Vulnerability Scanning)
    Failure to scan for and remediate known critical vulnerabilities in a timely manner violates this control. Patching must be part of the formal vulnerability management process.

Note: The patch commit 11980aaf3f46315b02777f325ba02c56b110165d directly addresses SA-12, SC-7, and SI-4 by introducing sandboxing and access controls.