CriticalVulnerability
CVE-2026-61729: SOCFortress CoPilot webhook authentication bypass via default header secret
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-61729
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
Summary
SOCFortress CoPilot versions before 0.1.76 authenticate Graylog and Velociraptor webhooks against the same publicly hardcoded fallback header value, which is also shipped in `.env.example`. Deployments that leave these header secrets unset or unchanged let an anonymous caller bypass JWT authentication and reach `POST /api/graylog/invoke`, which forwards attacker-selected commands to the configured Wazuh manager, and the alert creation endpoints, which accept forged alerts for arbitrary `customer_code` values. Active-response delivery requires a reachable Wazuh manager.
Mitigation
Fixed in 0.1.76. Deployments with independently changed header secrets are not subject to this default-secret bypass.
Topics
Related items
- HighCVE-2026-63378: TAKO AI Agent for Okta code execution via execute-script endpointSimilar attack · NVD/CVE Database
- CriticalCVE-2026-63377: TAKO AI Agent for Okta unauthenticated admin account creation via setup endpointSimilar attack · NVD/CVE Database
- HighCVE-2026-119337: RAGFlow agent chat completions API bypasses access check on private agentsSimilar attack · NVD/CVE Database
- MediumCVE-2026-119328: Immich unauthenticated /predict endpoint allows arbitrary cache deletionSimilar attack · NVD/CVE Database
- HighCVE-2026-119978: Flowise sandbox escape to OS command execution via node-custom-function endpointSimilar attack · NVD/CVE Database