Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-61730— SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount

Quick assessment

Affected
socfortress CoPilot
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

SOCFortress CoPilot 旨在为所有安全运营需求提供统一的可视化界面。在受影响的部署中， 中未经验证的 挂载点会暴露 目录，尽管常规的 路由需要 JWT 身份验证。生成的 HTML 报告以及 文件会泄露 AWS、Azure 和 GCP 的 IAM 主体、资源清单、配置错误及发现项。报告名称由调用者选定，并包含可预测的默认值。 在由管理员或分析师发起的 GCP 扫描期间， 会将上传的 Google 服务账号 JSON 密钥保存到同一由 Web 服务器提供的目录中。在 中， 函数仅在扫描完成后才会删除该密

CVSS 9.3 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61730

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount
Source: CVE Program / CVE List V5
Vulnerability Description
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected deployments, the unauthenticated `/scoutsuite-report` `StaticFiles` mount in `backend/copilot.py` exposes the `scoutsuite-report` directory even though normal /api routes require JWT authentication. Generated HTML reports and `scoutsuite-results/scoutsuite_results_<name>.js` files disclose AWS, Azure and GCP IAM principals, resource inventories, misconfigurations and findings. Report names derive from caller-selected names with predictable defaults. During an admin- or analyst-initiated GCP scan, `backend/app/integrations/scoutsuite/routes/scoutsuite.py` saves the uploaded Google service-account JSON key into that same web-served directory. In `backend/app/integrations/scoutsuite/services/scoutsuite.py`, `generate_gcp_report_background` removes the key only after the scan finishes. Any anonymous client that can reach the host and request the file path can therefore retrieve the private key during the scan and use the service account's cloud permissions, as well as read retained cloud-security reports. Credential isolation is released in version 0.1.77; a release fully remediating the report-disclosure component has not been established.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
socfortress CoPilot < 0.1.77 -

II. Public POCs for CVE-2026-61730

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61730

请登录查看更多情报信息。

Other References for CVE-2026-61730 (4)

Same Patch Batch · socfortress · 2026-10-30 · 6 CVEs total

CVE-2026-61738 10.0 CRITICAL SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuit
CVE-2026-61728 9.9 CRITICAL SOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeover
CVE-2026-61729 9.4 CRITICAL SOCFortress CoPilot: Hardcoded Default Header Secret - Unauthenticated Active-Response Inv
CVE-2026-61708 8.5 HIGH SOCFortress CoPilot: Cross-Tenant Arbitrary Object-Store Write via the Data-Store Upload E
CVE-2026-61739 7.5 HIGH SOCFortress CoPilot: Authentication Bypass and Missing Authorization on Velociraptor Sigma

IV. Related Vulnerabilities

Same product: CoPilot
Same vendor: socfortress
Same weakness: CWE-200