Is CVE-2026-42869 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42869 being exploited in the wild.

How severe is CVE-2026-42869?

Critical severity, with a CVSS score of 10, published 11 May 2026.

Is there a fix for CVE-2026-42869?

A patch was published on 2026-04-24: Fix committed and advisory published on GitHub Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-42869 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-42869?

Check whether you run SOCFortress CoPilot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42869: SOCFortress CoPilot hardcoded JWT secret fallback

CVE-2026-42869 · Severity: critical · CVSS 10 · Published 2026-05-11

SOCFortress CoPilot, a security operations management platform, contains a critical vulnerability where it uses a publicly known, hardcoded password to sign security tokens. Because this platform is designed to centralize control over various security tools (like Wazuh and Graylog), an attacker can use this known password to create their own administrative access tokens. This allows an unauthenticated person to take full control of the platform, access sensitive credentials for connected security systems, and potentially disable or manipulate the organization's entire security monitoring infrastructure.

Technologies: SOCFortress CoPilot. Vendors: SOCFortress.

Quick answers

Is CVE-2026-42869 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42869 being exploited in the wild.
How severe is CVE-2026-42869?: Critical severity, with a CVSS score of 10, published 11 May 2026.
Which products and versions are affected?: SOCFortress CoPilot < 0.1.57.
Is there a fix for CVE-2026-42869?: A patch was published on 2026-04-24: Fix committed and advisory published on GitHub Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42869 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42869?: Check whether you run SOCFortress CoPilot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

SOCFortress CoPilot prior to version 0.1.57 contains a hardcoded fallback value for the 'JWT_SECRET' in 'backend/app/auth/utils.py'. This secret is also provided verbatim in the '.env.example' file. In deployments where the administrator does not explicitly define a unique secret (including default Docker Compose installations), the application defaults to this publicly known value. An unauthenticated remote attacker can forge JSON Web Tokens (JWTs) with 'admin' scopes and 'sub=admin' claims. This leads to full administrative bypass, allowing the attacker to reset passwords, create backdoor accounts, and retrieve plaintext credentials for integrated security connectors (Wazuh, Graylog, etc.). The fix removes the fallback and implements a 'fail-fast' mechanism that prevents the application from starting if the compromised secret is detected.

Affected products

SOCFortress CoPilot < 0.1.57

Timeline

2026-04-24: patched: Fix committed and advisory published on GitHub
2026-05-11: advisory: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.