CVE-2026-42869: SOCFortress CoPilot hardcoded JWT signing secret allows forged admin tokens

Summary

CVE-2026-42869 affects SOCFortress CoPilot before 0.1.57. The backend ships a hardcoded JWT signing secret as a fallback in backend/app/auth/utils.py:28 and repeats it in .env.example. Deployments that leave JWT_SECRET unset, including the default Docker Compose setup, sign every authentication token with this public value, letting an unauthenticated attacker forge admin-scoped JWTs and take full control of the application and the security tools it manages.

Mitigation

Fixed in 0.1.57.

Topics

• Coding assistants

Related items

• MediumCVE-2026-102610: fast-agent serve unauthenticated remote command execution via /mcp endpointSimilar attack · NVD/CVE Database
• CriticalCVE-2026-58490: Tracecat SAML authentication bypass through unsigned responses in Docker ComposeSimilar attack · NVD/CVE Database
• MediumCVE-2026-124028: mistral.rs delimiter injection allows attacker-chosen tool calls via quoted textSimilar attack · NVD/CVE Database
• HighCVE-2026-123974: TorchServe local privilege escalation via predictable /tmp extraction directorySimilar attack · NVD/CVE Database
• InfoOpenAI Says New GPT-6 Cyber Model Hunts Flaws Without Crossing the LineSimilar attack · SecurityWeek