Zero Radar
← feed
CriticalVulnerabilityCVE-2026-61729updated 30 Oct 2026, 15:18 UTC

SOCFortress CoPilot can be bypassed with a public default password

Anyone who knows a built-in default password can skip the login and send commands to security tools, like making endpoints disruptive or forging alerts. The default is public because it ships in the sample settings file.

Fixed in Version 0.1.76 · out Official source
SeverityCriticalCVSS 9.4 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesVersion 0.1.76 · since 30 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1AttackerKnows the public default header value
  2. 2Webhook callSends request with the known header
  3. 3CoPilotAccepts header instead of JWT login
  4. 4Wazuh managerReceives attacker-chosen active-response command
  5. 5EndpointScript runs and disrupts the machine
  6. ResultAttacker disrupts endpoints and defenses

What happened

SOCFortress CoPilot before 0.1.76 uses the same hardcoded fallback value for the Graylog and Velociraptor webhook header checks, and the same default appears in .env.example. Webhook routes accept that header in place of JWT authentication, exposing active-response, alert-creation and OpenSearch query endpoints.

Why it is dangerous: An unauthenticated attacker can make the Wazuh manager run active-response scripts on endpoints, potentially disrupting them or changing defensive controls, and can inject forged alerts for any customer code.

Are you affected?

You are affected if you run SOCFortress CoPilot before 0.1.76 and left GRAYLOG_API_HEADER_VALUE or VELOCIRAPTOR_API_HEADER_VALUE unset or at the default value from .env.example.

SOCFortress CoPilot versions before 0.1.76 with default or unset GRAYLOG_API_HEADER_VALUE / VELOCIRAPTOR_API_HEADER_VALUE.

What to do

  1. Update SOCFortress CoPilot to version 0.1.76 or later
  2. Set GRAYLOG_API_HEADER_VALUE and VELOCIRAPTOR_API_HEADER_VALUE to unique, strong secrets
  3. Confirm the webhook routes reject requests that use the old default header value

Timeline

  1. 30 Oct 2026, 15:16 UTC
    Publicly disclosed
  2. 30 Oct 2026, 15:16 UTC
    Reported by NVD · NVD
  3. 30 Oct 2026, 15:18 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-61729
CVSS
9.4 / 10
Disclosed
30 Oct 2026, 15:16 UTC
On Zero Radar
30 Oct 2026, 15:18 UTC (2 min after disclosure)
Last change
30 Oct 2026, 15:18 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

SOCFortress CoPilot can be bypassed with a public default password · Zero Radar