CVE-2026-61729Critical· 9.4▾ AbyssalPoC availableSOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, `verify_graylog_header` in `backend/app/active_response/routes/graylog.py` and `verify_velociraptor_header` in `back…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 51.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.4%
Exploit / PoC code exists
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, verify_graylog_header in backend/app/active_response/routes/graylog.py and verify_velociraptor_header in backend/app/incidents/routes/incident_alert.py authenticate webhooks against GRAYLOG_API_HEADER_VALUE and VELOCIRAPTOR_API_HEADER_VALUE with the same publicly hardcoded fallback. The same default is shipped in .env.example. Deployments that leave either setting unset or unchanged permit an anonymous caller with the known header value to bypass the JWT authentication required by normal APIs. POST /api/graylog/invoke forwards attacker-selected COMMAND, ACTION, VALUE and AGENT_ID to the configured Wazuh manager without the command-enum validation of the authenticated invocation route, allowing active-response scripts to disrupt endpoints and manipulate defensive controls. POST /api/incidents/alerts/create/threshold and POST /api/incidents/alerts/create/velo-sigma accept forged alerts for arbitrary customer_code values and drive attacker-controlled OpenSearch queries. Active-response delivery requires a configured reachable Wazuh manager. Deployments with independently changed header secrets are not subject to this default-secret bypass. This issue is fixed in version 0.1.76.
CoPilot < 0.1.76Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-61728Critical· 9.9SOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeover
CVE-2026-61707Critical· 9.0SOCFortress CoPilot: Stored case-report template injection permits backend code execution
CVE-2026-61708High· 8.5SOCFortress CoPilot: Cross-Tenant Arbitrary Object-Store Write via the Data-Store Upload Endpoint (customer_user)
CVE-2026-61730Critical· 9.3SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount
CVE-2026-61739High· 7.5SOCFortress CoPilot: Authentication Bypass and Missing Authorization on Velociraptor Sigma Exclusion Rules (Detection Suppression)
CVE-2026-61738Critical· 10.0SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE)