CVE-2026-61729: SOCFortress CoPilot: Hardcoded Default Header Secret - Unauthenticated Active-Response Invocation and Alert Injection

Severity: critical (CVSS 9.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-30 · updated 2026-10-30
Weakness: CWE-306

Description

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, `verify_graylog_header` in `backend/app/active_response/routes/graylog.py` and `verify_velociraptor_header` in `backend/app/incidents/routes/incident_alert.py` authenticate webhooks against `GRAYLOG_API_HEADER_VALUE` and `VELOCIRAPTOR_API_HEADER_VALUE` with the same publicly hardcoded fallback. The same default is shipped in `.env.example`. Deployments that leave either setting unset or unchanged permit an anonymous caller with the known header value to bypass the JWT authentication required by normal APIs. `POST /api/graylog/invoke` forwards attacker-selected `COMMAND`, `ACTION`, `VALUE` and `AGENT_ID` to the configured Wazuh manager without the command-enum validation of the authenticated invocation route, allowing active-response scripts to disrupt endpoints and manipulate defensive controls. `POST /api/incidents/alerts/create/threshold` and `POST /api/incidents/alerts/create/velo-sigma` accept forged alerts for arbitrary `customer_code` values and drive attacker-controlled OpenSearch queries. Active-response delivery requires a configured reachable Wazuh manager. Deployments with independently changed header secrets are not subject to this default-secret bypass. This issue is fixed in version 0.1.76.

Summary

SOCFortress CoPilot before 0.1.76 ships a hardcoded default header secret used by the Graylog and Velociraptor webhook verification functions, and the same value appears in .env.example. Deployments that leave GRAYLOG_API_HEADER_VALUE or VELOCIRAPTOR_API_HEADER_VALUE unset or unchanged let an unauthenticated attacker with the known header bypass JWT authentication, invoke active-response commands against the Wazuh manager without command validation, and inject forged alerts that drive attacker-controlled OpenSearch queries. This is rated critical (CVSS 9.4) but is not listed in CISA KEV, and no exploitation is confirmed in the provided facts. Upgrade to 0.1.76; if immediate patching is not possible, set both header values to unique, non-default secrets.

يحتوي SOCFortress CoPilot قبل الإصدار 0.1.76 على سرّ ترويسة افتراضي مضمَّن في الشيفرة تستخدمه دوال التحقق من webhooks الخاصة بـ Graylog وVelociraptor، وتظهر القيمة نفسها في ملف .env.example. العمليات المنشورة التي تترك GRAYLOG_API_HEADER_VALUE أو VELOCIRAPTOR_API_HEADER_VALUE دون تعيين أو دون تغيير تسمح لمهاجم غير مصادَق يملك قيمة الترويسة المعروفة بتجاوز مصادقة JWT، واستدعاء أوامر الاستجابة النشطة على مدير Wazuh دون التحقق من الأوامر، وحقن تنبيهات مزوّرة تقود استعلامات OpenSearch يتحكم بها المهاجم. التقييم حرج (CVSS 9.4) لكنه غير مدرج في CISA KEV، ولا تؤكد المعطيات المتاحة وجود استغلال فعلي. الحل هو الترقية إلى 0.1.76، وإن تعذّر ذلك فورًا فيجب تعيين قيمتي الترويسة إلى سرّين فريدين غير افتراضيين.

Affected products

socfortress CoPilot: before 0.1.76

References

Get alerted when CVE-2026-61729 or the next vulnerability affects your stack