External risk intelligence

SOCFortress CoPilot Hardcoded Secret Bypass Enables Forged Alerts and Active Response

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-61729

The vulnerability exists in API endpoints designed to receive webhooks from security tools like Graylog and Velociraptor. These endpoints are commonly exposed to network traffic to facilitate integration between disparate security services, making them reachable in typical deployment patterns where the CoPilot backend interacts with external security infrastructure.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in SOCFortress CoPilot, a security operations platform. Prior to version 0.1.76, the system's handling of webhooks from security tools could allow unauthorized access, potentially enabling attackers to execute commands on your security management systems or manipulate data. The primary concern is confirming if your deployment uses default, hardcoded security values, which would expose you to this risk.

Default security values can be bypassed.
Allows unauthorized commands and data manipulation.
Confirm relevance and exposure of default settings.

Attack Path

How an attacker could exploit the issue

An attacker can bypass authentication by sending a specially crafted webhook request to specific API endpoints, provided the default hardcoded header values have not been changed. This allows them to invoke actions on a connected Wazuh manager, submit forged alerts, and potentially disrupt security controls or manipulate data.

Unchanged default webhook headers.
Sending webhook to vulnerable API.
Disrupt security controls and manipulate data.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, deployments that retain the default hardcoded webhook header values could allow an unauthenticated attacker to bypass authentication. This could enable an attacker to disrupt endpoints, manipulate defensive controls via the Wazuh manager, or inject malicious queries into OpenSearch by submitting forged alerts.

System configuration and integrity.
Unauthenticated webhook requests.
Disruption of defensive controls.

Operational Fix

Recommended remediation, mitigation, and detection steps

SOCFortress CoPilot deployments that have not updated their hardcoded API header secrets are vulnerable. The initial focus should be on identifying CoPilot instances, confirming their network exposure and business criticality, and locating the accountable owner for remediation. This will inform a prioritized plan to address the risk posed by unauthenticated webhook access and potential manipulation of defensive controls and security alerts.

Platform/Security teams own the issue.
Verify webhook configurations and custom secrets.
Plan remediation based on exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SOCFortress CoPilot?

SOCFortress CoPilot is a security operations platform designed to aggregate data and alerts from various security tools into a single dashboard. It integrates with external services like Graylog and Velociraptor to streamline incident response and monitoring, often acting as a central hub that communicates with other defensive systems, such as a Wazuh manager, to orchestrate active security responses.

What does CWE-798 and CWE-306 mean for CVE-2026-61729?

This vulnerability involves the use of hardcoded credentials (CWE-798) and a failure to perform authentication for critical functions (CWE-306). Because the software relies on a default, publicly known value to verify incoming webhooks, it fails to confirm the identity of the sender. Consequently, the system treats unauthorized requests as legitimate, granting attackers the same permissions as authorized security tools.

When can an attacker trigger this vulnerability?

An attacker can trigger this flaw if a deployment uses the default, unchanged header values for its Graylog or Velociraptor integrations. If an administrator has manually updated these settings to unique, custom secrets, the vulnerability is not triggered. The bug specifically relies on the presence of the static, default secret value to bypass the expected JWT authentication process.

Is my instance at risk according to Halo Surface Signal?

Halo Surface Signal indicates a 'Likely' risk because these API endpoints are designed to accept incoming traffic from external security tools. Since these services are often exposed to network traffic to ensure successful integration, they are frequently reachable by unauthorized actors. You should assess if your specific integration endpoints are reachable over your network.

How do I secure my CoPilot deployment?

The primary fix is to upgrade to version 0.1.76 or later. If you cannot update immediately, you must ensure that all default API header secrets for Graylog and Velociraptor are changed from their factory settings. Review your environment configuration files to replace these defaults with unique, complex values to prevent unauthorized access to your API endpoints.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.