CVE-2026-61708High· 8.5▾ TwilightSOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, `POST /api/agent_data_store/upload` in `backend/app/data_store/data_store_routes.py` permits `customer_user` callers…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, POST /api/agent_data_store/upload in backend/app/data_store/data_store_routes.py permits customer_user callers to choose bucket_name and object_name without an allowlist, tenant prefix, ownership check or content restriction. The only file check requires a nonempty filename. The operations in backend/app/data_store/data_store_operations.py create missing buckets and upsert objects, allowing existing objects belonging to any tenant to be overwritten. Targets include sysmon-configs/<customer_code>/sysmon_config.xml distributed to managed Windows endpoints, copilot-case-report-templates/<name> rendered server-side, and case evidence or forensic artifacts under copilot-cases/<case_id>/<file> and velociraptor-artifacts/<agent_id>/<flow_id>/<file>. A lowest-privilege user can tamper with cross-tenant evidence, blind endpoint telemetry, poison report templates for later code execution, plant data or exhaust storage. Sibling list, download and delete routes remain restricted to admin/analyst; the exposed operation is the upload write path. This issue is fixed in version 0.1.76.
CoPilot < 0.1.76Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-61707Critical· 9.0SOCFortress CoPilot: Stored case-report template injection permits backend code execution
CVE-2026-61739High· 7.5SOCFortress CoPilot: Authentication Bypass and Missing Authorization on Velociraptor Sigma Exclusion Rules (Detection Suppression)
CVE-2026-61729Critical· 9.4SOCFortress CoPilot: Hardcoded Default Header Secret - Unauthenticated Active-Response Invocation and Alert Injection
CVE-2026-61728Critical· 9.9SOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeover
CVE-2026-61730Critical· 9.3SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount
CVE-2026-61738Critical· 10.0SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE)