Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-61729— SOCFortress CoPilot: Hardcoded Default Header Secret - Unauthenticated Active-Response Invocation and Alert Injection

Quick assessment

Affected

socfortress CoPilot

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SOCFortress CoPilot 旨在为所有安全运营需求提供统一的可视化操作界面。在 0.1.76 版本之前，中的函数与中的函数，均使用相同的公开硬编码默认值对 Webhook 进行身份验证，分别对应和配置项。该默认值同样包含在示例文件中。若部署时未设置或保留这些配置项的默认值，攻击者即可利用已知的默认头值，绕过常规 API 所需的 JWT 身份验证。具体而言，接口会将攻击者指定的、、和参数直接转发至配置的 Wazuh 管理器，且未经过已认证调用路线所具备的命令枚举验证，从而允许通过

CVSS 9.4 · Critical Updated Oct 30, 2026

Possible ATT&CK Techniques 3 AI

T1562 T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

SOCFortress CoPilot: Hardcoded Default Header Secret - Unauthenticated Active-Response Invocation and Alert Injection

Source: CVE Program / CVE List V5

Vulnerability Description

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, `verify_graylog_header` in `backend/app/active_response/routes/graylog.py` and `verify_velociraptor_header` in `backend/app/incidents/routes/incident_alert.py` authenticate webhooks against `GRAYLOG_API_HEADER_VALUE` and `VELOCIRAPTOR_API_HEADER_VALUE` with the same publicly hardcoded fallback. The same default is shipped in `.env.example`. Deployments that leave either setting unset or unchanged permit an anonymous caller with the known header value to bypass the JWT authentication required by normal APIs. `POST /api/graylog/invoke` forwards attacker-selected `COMMAND`, `ACTION`, `VALUE` and `AGENT_ID` to the configured Wazuh manager without the command-enum validation of the authenticated invocation route, allowing active-response scripts to disrupt endpoints and manipulate defensive controls. `POST /api/incidents/alerts/create/threshold` and `POST /api/incidents/alerts/create/velo-sigma` accept forged alerts for arbitrary `customer_code` values and drive attacker-controlled OpenSearch queries. Active-response delivery requires a configured reachable Wazuh manager. Deployments with independently changed header secrets are not subject to this default-secret bypass. This issue is fixed in version 0.1.76.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

关键功能的认证机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
socfortress	CoPilot	< 0.1.76	-

II. Public POCs for CVE-2026-61729

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-61729

请登录查看更多情报信息。

Vendor Pages for CVE-2026-61729 (1)

🔗 GitHub - socfortress/CoPilot at v0.1.76 · GitHub x_refsource_MISC

Other References for CVE-2026-61729 (3)

https://github.com/socfortress/CoPilot/pull/939 x_refsource_MISC
https://github.com/socfortress/CoPilot/security/advisories/GHSA-x8gc-f8p4-frc2 x_refsource_CONFIRM
https://github.com/socfortress/CoPilot/commit/1b2c3f97243988301285b395ce4239769c66bd9e x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-61729

Same Patch Batch · socfortress · 2026-10-30 · 6 CVEs total

CVE-2026-61738	10.0 CRITICAL	SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuit
CVE-2026-61728	9.9 CRITICAL	SOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeover
CVE-2026-61730	9.3 CRITICAL	SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Servi
CVE-2026-61708	8.5 HIGH	SOCFortress CoPilot: Cross-Tenant Arbitrary Object-Store Write via the Data-Store Upload E
CVE-2026-61739	7.5 HIGH	SOCFortress CoPilot: Authentication Bypass and Missing Authorization on Velociraptor Sigma

IV. Related Vulnerabilities

Same product: CoPilot

Same vendor: socfortress

Same weakness: CWE-306