Approved changes feed: RSS · Atom
cpe:2.3:a:karutoil:catalyst:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Karutoil (0a41abd9-de68-57a3-88e1-d929f0df9c3b) |
|---|---|
| Product | Catalyst (67d160ed-fb60-5dc9-be8b-2dbc70f31c32) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-26009 |
vulnerable | 2026-06-08 07:53:20.703871 |
Catalyst Affected by Remote Code Execution as Root via Containerized Install Script Execution
CRITICAL (10)
Catalyst is a platform built for enterprise game server hosts, game communities, and billing panel integrations. Install scripts defined in server templates execute directly on the host operating system as root via bash -c, with no sandboxing or containerization. Any user with template.create or template.update permission can define arbitrary shell commands that achieve full root-level remote code execution on every node machine in the cluster. This vulnerability is fixed in commit 11980aaf3f46315b02777f325ba02c56b110165d.
Published: 2026-02-10T18:58:02.732Z
Updated: 2026-02-10T19:10:21.719Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.