Zero Radar
← feed
CriticalVulnerabilityCVE-2026-61730updated 30 Oct 2026, 15:18 UTC

SOCFortress CoPilot exposes cloud security reports and GCP keys without login

Anyone who can reach the CoPilot server can open cloud security reports without logging in. During a Google Cloud scan, the uploaded Google account key can also be downloaded by strangers, letting them act as that account in your cloud.

Partial fix · out Official source
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?PartlyCredential isolation released in version 0.1.77. Full remediation of the report-disclosure component has not been established. · since 30 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Anonymous visitorNo login or token needed
  2. 2Requests file pathGuesses predictable report names
  3. 3Unauthenticated mount/scoutsuite-report serves files directly
  4. 4GCP key downloadedKey stays there during the scan
  5. 5Cloud accessUses service account permissions
  6. ResultAttacker reads reports and controls the GCP account

What happened

The /scoutsuite-report static mount in CoPilot's backend serves the scoutsuite-report directory without JWT authentication, exposing generated AWS, Azure and GCP reports and results files, and temporarily storing uploaded GCP service-account JSON keys there during scans.

Why it is dangerous: Attackers can learn cloud IAM principals, resource inventories and misconfigurations, and may steal a GCP service-account key to access cloud resources; teams running CoPilot with cloud scans are at risk.

Are you affected?

You are affected if you run SOCFortress CoPilot with ScoutSuite cloud scanning enabled (AWS, Azure or GCP) on a host reachable by others, before version 0.1.77.

SOCFortress CoPilot versions prior to 0.1.77 (credential isolation fixed in 0.1.77; report disclosure not fully fixed as of advisory).

What to do

  1. Upgrade SOCFortress CoPilot to version 0.1.77 or later
  2. Block public access to the CoPilot server so only trusted networks can reach it
  3. Delete existing files in the scoutsuite-report directory and rotate any GCP service-account keys that were uploaded
  4. Review access logs for requests to /scoutsuite-report and check the affected cloud accounts for misuse

Timeline

  1. 30 Oct 2026, 15:16 UTC
    Publicly disclosed
  2. 30 Oct 2026, 15:16 UTC
    Reported by NVD · NVD
  3. 30 Oct 2026, 15:18 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-61730
CVSS
9.3 / 10
Disclosed
30 Oct 2026, 15:16 UTC
On Zero Radar
30 Oct 2026, 15:18 UTC (2 min after disclosure)
Last change
30 Oct 2026, 15:18 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

SOCFortress CoPilot exposes cloud security reports and GCP keys without login · Zero Radar