External risk intelligence

SOCFortress CoPilot Report Disclosure of Cloud Credentials

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-61730

SOCFortress CoPilot is designed as a centralized dashboard for security operations. As a web-based application intended to aggregate data and provide a single pane of glass for security monitoring, it is commonly deployed as a web application or management service that is accessible to authorized users over the network, increasing the likelihood of its web-accessible paths being reachable.

Information Disclosure

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in SOCFortress CoPilot, a security operations platform. The issue allows unauthenticated access to sensitive cloud security reports and could expose private cloud credentials used during scans. At a high level, this means that sensitive information about cloud environments and access keys might be discoverable by unauthorized parties.

Sensitive cloud data and credentials may be exposed.
Leadership should remember this for potential audit and compliance.
Confirm relevance and exposure of this security tool.

Attack Path

How an attacker could exploit the issue

An attacker can access sensitive cloud credentials and security reports by targeting the unauthenticated `/scoutsuite-report` endpoint. When an administrator or analyst initiates a cloud scan, the system saves the uploaded service account key to this publicly accessible directory. An anonymous attacker, if they can reach the host, can then retrieve the private key during the scan and use the associated cloud permissions, in addition to viewing the exposed security reports.

Unauthenticated network access is required.
Anonymous clients can request report files.
Leaked cloud credentials and security findings.

Live Threat

Current exploitation, exposure, and threat context

In affected deployments, unauthenticated access to a specific file path could expose sensitive cloud security reports and Google service account private keys. These reports may contain details about AWS, Azure, and GCP IAM principals, resource inventories, misconfigurations, and findings. When a GCP scan is initiated, the Google service account JSON key is temporarily saved in a web-served directory before being removed, creating a window for retrieval by unauthenticated clients.

Cloud security reports and IAM keys.
Anonymous clients access exposed files.
Compromised cloud permissions and data.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for managing SOCFortress CoPilot deployments. The first practical step is to identify all instances of CoPilot, determine their network exposure and business criticality, and locate the accountable owner for each. This will allow for a prioritized remediation plan based on risk.

Identify accountable application owners.
Verify network exposure and criticality.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SOCFortress CoPilot?

SOCFortress CoPilot is a security operations platform designed to provide a centralized dashboard for managing security tasks. It functions as a web-based management service that aggregates data from various sources, helping teams monitor cloud environments and security configurations in one place.

What does CVE-2026-61730 mean?

This vulnerability involves improper access control and exposure of sensitive information, classified under weaknesses like CWE-200 and CWE-306. Essentially, the software inadvertently publishes files, including cloud security reports and private authentication keys, to a location that does not require users to log in.

How can an attacker trigger this bug?

An attacker needs network access to the host running the software. They can then request specific files from the unprotected report directory. Notably, simply browsing the directory does not always yield a private key; the key is only briefly stored there while a GCP scan is actively running, creating a narrow window of opportunity.

Is my CoPilot instance at risk?

If your instance is reachable over the network, Halo Surface Signal identifies it as a likely target because CoPilot is a web-based tool often deployed in accessible environments. You should evaluate if the web interface is exposed to the internet or reachable by unauthorized users within your network.

What should I do to secure my system?

Start by inventorying all CoPilot deployments and verifying which ones are exposed to network traffic. Identify the owners for these instances to coordinate an update. Check if you can apply version 0.1.77, which addresses the credential isolation issue, and restrict network access to the application in the meantime.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.