Read the docs
TI-2026-31075 Aliases CVE-2026-42869

Improper authentication in socfortress CoPilot

Priority HIGH 82CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287 and CWE-522.

Summary

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.57, SOCFortress CoPilot ships a hardcoded JWT signing secret as a fallback value in backend/app/auth/utils.py:28 and ships it verbatim in .env.example. Any deployment where JWT_SECRET is not explicitly set — including the default Docker Compose setup — signs all authentication tokens with this publicly known value. An unauthenticated attacker can forge arbitrary admin-scoped JWTs and gain full control of the application and every security tool it manages without any credentials. This vulnerability is fixed in 0.1.57.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00563 47th percentileScored 2026-11-07
Fix Fixed CoPilot (socfortress): 0.1.57

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
socfortressCoPilotbefore 0.1.570.1.57Patch availableCNA
  • CoPilot Vendorsocfortress Affected before 0.1.57 Fixed in 0.1.57 Patch available CNA

Remediation

  • Fix · CNA CoPilot (socfortress) Fixed in 0.1.57

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42869
  2. 2026-10-25 EPSS moved to the below the 50th percentile

References

Other 3

  • TI-2026-83110 Path traversal in SOCFortress CoPilot lets attackers write host files CVSS 3.1CRITICAL 10.0
  • TI-2026-83107 Hardcoded default secret in SOCFortress CoPilot allows auth bypass CVSS 3.1CRITICAL 9.4
  • TI-2026-83106 SOCFortress CoPilot stored XSS enables privileged account takeover CVSS 3.1CRITICAL 9.9
  • TI-2026-83146 Authentication bypass in SOCFortress CoPilot Sigma exclusions CVSS 3.1HIGH 7.5
  • TI-2026-83108 SOCFortress CoPilot exposes ScoutSuite reports and GCP keys CVSS 3.1CRITICAL 9.3
  • TI-2026-82778 Stored template injection in SOCFortress CoPilot allows backend code execution CVSS 3.1CRITICAL 9.0
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences