Authentication Bypass in SOCFortress CoPilot
CVE-2026-61729

9.4CRITICAL

Key Information:

Vendor

Socfortress

Status
Copilot
Vendor
CVE Published:
30 October 2026

What is CVE-2026-61729?

The vulnerability in SOCFortress CoPilot prior to version 0.1.76 allows an attacker to bypass JWT authentication due to the use of hardcoded fallback values in webhook verification. If deployed with default settings or unset headers, unauthorized callers can exploit this flaw, which enables them to manipulate commands and actions sent to the configured Wazuh manager. This can result in interception and disruption of security operations, as attackers can forge alerts and execute arbitrary queries against OpenSearch, compromising system integrity. The issue has been addressed in version 0.1.76.

Affected Version(s)

CoPilot < 0.1.76

References

https://github.com/socfortress/CoPilot/security/advisorie...
x_refsource_CONFIRM
https://github.com/socfortress/CoPilot/pull/939
x_refsource_MISC
https://github.com/socfortress/CoPilot/commit/1b2c3f97243...
x_refsource_MISC

CVSS V3.1

Score:
9.4
Severity:
CRITICAL
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.