Data Exposure Vulnerability in SOCFortress CoPilot Affecting Cloud Credentials

CVE-2026-61730

What is CVE-2026-61730?

In deployments of SOCFortress CoPilot, a vulnerability exists where the unauthenticated '/scoutsuite-report' endpoint exposes critical information. This includes HTML reports revealing AWS, Azure, and GCP IAM principals, along with resource inventories and findings. The predictable file naming allows unauthorized users to access sensitive documents. Additionally, during GCP scans, service account JSON keys can be saved in the web-accessible directory, allowing malicious actors to retrieve private keys when scans are initiated, granting them access to significant cloud permissions. A patch in version 0.1.77 addresses credential isolation, but a thorough fix for report disclosures is still forthcoming.

References