CVE-2026-61729 in CoPilot
Summary
by MITRE • 10/30/2026
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, `verify_graylog_header` in `backend/app/active_response/routes/graylog.py` and `verify_velociraptor_header` in `backend/app/incidents/routes/incident_alert.py` authenticate webhooks against `GRAYLOG_API_HEADER_VALUE` and `VELOCIRAPTOR_API_HEADER_VALUE` with the same publicly hardcoded fallback. The same default is shipped in `.env.example`. Deployments that leave either setting unset or unchanged permit an anonymous caller with the known header value to bypass the JWT authentication required by normal APIs. `POST /api/graylog/invoke` forwards attacker-selected `COMMAND`, `ACTION`, `VALUE` and `AGENT_ID` to the configured Wazuh manager without the command-enum validation of the authenticated invocation route, allowing active-response scripts to disrupt endpoints and manipulate defensive controls. `POST /api/incidents/alerts/create/threshold` and `POST /api/incidents/alerts/create/velo-sigma` accept forged alerts for arbitrary `customer_code` values and drive attacker-controlled OpenSearch queries. Active-response delivery requires a configured reachable Wazuh manager. Deployments with independently changed header secrets are not subject to this default-secret bypass. This issue is fixed in version 0.1.76.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in SOCFortress CoPilot prior to version 0.1.76 represents a critical authentication bypass and insecure configuration flaw rooted in the use of hardcoded fallback credentials for webhook verification mechanisms. Specifically, the functions verify_graylog_header within backend/app/active_response/routes/graylog.py and verify_velociraptor_header within backend/app/incidents/routes/incident_alert.py were designed to authenticate incoming webhooks against specific environment variables GRAYLOG_API_HEADER_VALUE and VELOCIRAPTOR_API_HEADER_VALUE respectively. However, these verification routines utilized a publicly hardcoded fallback value when the respective environment variables were not explicitly set or remained at their default state. This design decision effectively created a backdoor where any actor possessing knowledge of this static default header could successfully authenticate as an authorized user for these specific endpoints, thereby circumventing the standard JSON Web Token authentication that protects other API routes within the application.
This flaw is directly linked to CWE-798 Use of Hard-coded Credentials and CWE-250 Execution with Unnecessary Privileges, as it allows unauthenticated actors to perform actions intended only for privileged users or trusted systems. The presence of this default secret in the .env.example file further exacerbates the risk by providing potential attackers with a ready-made credential set commonly found in open-source repositories and documentation. Deployments that fail to override these defaults during initialization are left vulnerable, allowing anonymous callers to bypass security controls entirely. This scenario aligns with ATT&CK technique T1078 Valid Accounts, where adversaries leverage legitimate credentials or configuration weaknesses to gain unauthorized access without needing to exploit a software bug in the traditional sense of memory corruption or logic errors beyond the authentication mechanism itself.
The operational impact of this vulnerability is severe due to the specific functionality exposed through these compromised endpoints. The POST /api/graylog/invoke route, when accessed via the bypassed webhook verification, forwards attacker-selected parameters including COMMAND, ACTION, VALUE, and AGENT_ID directly to a configured Wazuh manager. Crucially, this invocation path lacks the command-enum validation present in authenticated API routes. This absence of input validation allows an attacker to execute arbitrary active-response scripts on the connected Wazuh infrastructure. Such capabilities enable the disruption of security endpoints, manipulation of defensive controls, and potentially the disabling or alteration of monitoring agents across the network. The ability to send unvalidated commands significantly increases the blast radius of a successful exploitation, turning a simple authentication bypass into a potential remote code execution vector against the underlying security management platform.
Furthermore, the vulnerability extends beyond active response capabilities through the endpoints POST /api/incidents/alerts/create/threshold and POST /api/incidents/alerts/create/velo-sigma. These routes accept forged alerts containing arbitrary customer_code values and drive attacker-controlled OpenSearch queries. This allows an adversary to inject false positive or negative incidents into the system, potentially obscuring real attacks through alert fatigue or manipulating incident response workflows based on fabricated data. The exploitation of these endpoints requires a configured and reachable Wazuh manager, meaning that while the authentication bypass is local to the SOCFortress application logic, its full impact depends on the integration with external security tools. However, even without immediate remote code execution, the ability to manipulate incident data compromises the integrity of the Security Operations Center's situational awareness.
Mitigation for this issue involves upgrading to version 0.1.76 or later, where these hardcoded fallbacks have been removed and proper authentication checks enforced. For organizations unable to upgrade immediately, it is imperative to ensure that GRAYLOG_API_HEADER_VALUE and VELOCIRAPTOR_API_HEADER_VALUE are set to strong, unique secrets in the production environment configuration files rather than relying on defaults. Additionally, security teams should audit their .env.example usage practices to prevent default credentials from being committed to version control systems or exposed in public documentation. Network segmentation strategies can also limit exposure by ensuring that webhook endpoints are not directly accessible from untrusted networks without additional proxy-based authentication layers. Continuous monitoring for unusual activity patterns on these specific API routes, such as unexpected command executions or anomalous OpenSearch query structures, provides a defensive layer against exploitation of this vulnerability in legacy deployments.