CVE-2026-61730: SOCFortress CoPilot unauthenticated access to ScoutSuite reports and GCP keys
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-61730
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
Summary
SOCFortress CoPilot exposes its `scoutsuite-report` directory through an unauthenticated `/scoutsuite-report` StaticFiles mount in `backend/copilot.py`, even though normal /api routes require JWT authentication. The directory holds generated AWS, Azure and GCP reports and `scoutsuite-results/scoutsuite_results_<name>.js` files that disclose IAM principals, resource inventories and findings. During a GCP scan, the uploaded Google service-account JSON key is saved into that same web-served directory and removed only after the scan finishes, so an anonymous client can retrieve it and use the service account's cloud permissions.
Mitigation
Credential isolation is released in version 0.1.77; a release fully remediating the report-disclosure component has not been established.
Topics
Related items
- HighCVE-2026-63378: TAKO AI Agent for Okta code execution via execute-script endpointSimilar attack · NVD/CVE Database
- CriticalCVE-2026-63377: TAKO AI Agent for Okta unauthenticated admin account creation via setup endpointSimilar attack · NVD/CVE Database
- HighCVE-2026-119337: RAGFlow agent chat completions API bypasses access check on private agentsSimilar attack · NVD/CVE Database
- MediumCVE-2026-119328: Immich unauthenticated /predict endpoint allows arbitrary cache deletionSimilar attack · NVD/CVE Database
- HighCVE-2026-119978: Flowise sandbox escape to OS command execution via node-custom-function endpointSimilar attack · NVD/CVE Database