Critical · published February 10, 2026
🚨 A crafty lack of sandboxing in Catalyst lets any user with template permissions execute commands as root! 🔥 Think of it like a restaurant where anyone with a sharpie can change the order tickets directly, leading to anything from a simple burger to an explosive chili surprise being served in the kitchen. With this kind of access, the safety of the entire operation is put at risk! An attacker can potentially seize full control over the game server host, capable of executing any command. This could lead to data breaches, unauthorized changes, and total chaos in every node machine throughout the cluster—a recipe for disaster that could severely compromise your entire gaming environment!
Think of it like a restaurant where anyone with a sharpie can change the order tickets directly, leading to anything from a simple burger to an explosive chili surprise being served in the kitchen. With this kind of access, the safety of the entire operation is put at risk! The vulnerability allows users with 'template.create' or 'template.update' permissions to run arbitrary commands on the host system as root through the use of insecure install scripts, exposing the system to remote code execution without any protection mechanisms in place.
An attacker can potentially seize full control over the game server host, capable of executing any command. This could lead to data breaches, unauthorized changes, and total chaos in every node machine throughout the cluster—a recipe for disaster that could severely compromise your entire gaming environment! Immediately patch to the latest version that includes commit 11980aaf3f46315b02777f325ba02c56b110165d. Review user permissions to limit who can create or update templates. Implement sandboxing or containerization for any future command executions to enhance security. 🛡️ You've got this! Follow these steps and your game server environment will be much safer in no time! 🎮✨