# CVE-2026-42869: SOCFortress CoPilot hardcoded JWT secret fallback

Source: https://junglewise.ai/threats/cve-2026-42869-socfortress-copilot-hardcoded-jwt-secret-fallback  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-42869 · Severity: critical · CVSS 10 · Published 2026-05-11

SOCFortress CoPilot, a security operations management platform, contains a critical vulnerability where it uses a publicly known, hardcoded password to sign security tokens. Because this platform is designed to centralize control over various security tools (like Wazuh and Graylog), an attacker can use this known password to create their own administrative access tokens. This allows an unauthenticated person to take full control of the platform, access sensitive credentials for connected security systems, and potentially disable or manipulate the organization's entire security monitoring infrastructure.

Technologies: [SOCFortress CoPilot](https://junglewise.ai/threats/technologies/copilot). Vendors: [SOCFortress](https://junglewise.ai/threats/vendors/socfortress).

## Quick answers

**Is CVE-2026-42869 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42869 being exploited in the wild.

**How severe is CVE-2026-42869?** Critical severity, with a CVSS score of 10, published 11 May 2026.

**Which products and versions are affected?** SOCFortress CoPilot < 0.1.57.

**Is there a fix for CVE-2026-42869?** A patch was published on 2026-04-24: Fix committed and advisory published on GitHub Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42869 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-42869?** Check whether you run SOCFortress CoPilot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

SOCFortress CoPilot prior to version 0.1.57 contains a hardcoded fallback value for the 'JWT_SECRET' in 'backend/app/auth/utils.py'. This secret is also provided verbatim in the '.env.example' file. In deployments where the administrator does not explicitly define a unique secret (including default Docker Compose installations), the application defaults to this publicly known value. An unauthenticated remote attacker can forge JSON Web Tokens (JWTs) with 'admin' scopes and 'sub=admin' claims. This leads to full administrative bypass, allowing the attacker to reset passwords, create backdoor accounts, and retrieve plaintext credentials for integrated security connectors (Wazuh, Graylog, etc.). The fix removes the fallback and implements a 'fail-fast' mechanism that prevents the application from starting if the compromised secret is detected.

## Affected products

- SOCFortress CoPilot < 0.1.57

## Timeline

- 2026-04-24: patched: Fix committed and advisory published on GitHub
- 2026-05-11: advisory: CVE published to NVD

## References

- [https://github.com/socfortress/CoPilot/commit/4640511a0cf2e7b144a71375b5b349a8318cb186](https://github.com/socfortress/CoPilot/commit/4640511a0cf2e7b144a71375b5b349a8318cb186)
- [https://github.com/socfortress/CoPilot/pull/814](https://github.com/socfortress/CoPilot/pull/814)
- [https://github.com/socfortress/CoPilot/security/advisories/GHSA-4gxj-hw3c-3x2x](https://github.com/socfortress/CoPilot/security/advisories/GHSA-4gxj-hw3c-3x2x)

## Related threats

- [SOCFortress CoPilot authorization bypass in Velociraptor Sigma exclusion endpoints](https://junglewise.ai/threats/cve-2026-61739-socfortress-copilot-focuses-on-providing-a-single-pane-of-glass)
- [SOCFortress CoPilot path traversal in ScoutSuite report upload](https://junglewise.ai/threats/cve-2026-61738-socfortress-copilot-focuses-on-providing-a-single-pane-of-glass)
- [SOCFortress CoPilot unauthenticated GCP credential and report exposure](https://junglewise.ai/threats/cve-2026-61730-socfortress-copilot-focuses-on-providing-a-single-pane-of-glass)
- [SOCFortress CoPilot hardcoded webhook secret authentication bypass](https://junglewise.ai/threats/cve-2026-61729-socfortress-copilot-focuses-on-providing-a-single-pane-of-glass)
- [SOCFortress CoPilot stored cross-site scripting in alerts and cases](https://junglewise.ai/threats/cve-2026-61728-socfortress-copilot-focuses-on-providing-a-single-pane-of-glass)