Is CVE-2026-61729 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61729 being exploited in the wild.

How severe is CVE-2026-61729?

Critical severity, with a CVSS score of 9.4, published 30 October 2026.

Which products and versions are affected?

SOCFortress CoPilot prior to 0.1.76.

How is CVE-2026-61729 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-61729?

Check whether you run SOCFortress CoPilot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61729: SOCFortress CoPilot hardcoded webhook secret authentication bypass

CVE-2026-61729 · Severity: critical · CVSS 9.4 · Published 2026-10-30

SOCFortress CoPilot is a security operations dashboard that centralizes incident management and active response controls for security teams. Prior to version 0.1.76, the application shipped with hardcoded default secrets for webhook authentication, allowing an unauthenticated attacker to invoke active-response commands on endpoints (such as disabling firewall rules) and inject false security alerts. This affects any deployment that did not manually override the default secrets.

Technologies: SOCFortress CoPilot. Vendors: SOCFortress.

Quick answers

Is CVE-2026-61729 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61729 being exploited in the wild.
How severe is CVE-2026-61729?: Critical severity, with a CVSS score of 9.4, published 30 October 2026.
Which products and versions are affected?: SOCFortress CoPilot prior to 0.1.76.
Is there a fix for CVE-2026-61729?: Yes: fixed in 0.1.76. Until then: Upgrade to version 0.1.76 or later. For deployments unable to upgrade immediately, manually set unique values for GRAYLOG_API_HEADER_VALUE and VELOCIRAPTOR_API_HEADER_VALUE environment variables and update the corresponding request headers in Graylog and Velociraptor configurations to match. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61729 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-61729?: Check whether you run SOCFortress CoPilot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.1.76

Upgrade to version 0.1.76 or later. For deployments unable to upgrade immediately, manually set unique values for GRAYLOG_API_HEADER_VALUE and VELOCIRAPTOR_API_HEADER_VALUE environment variables and update the corresponding request headers in Graylog and Velociraptor configurations to match.

Technical details

Two webhook header validators (`verify_graylog_header` and `verify_velociraptor_header`) fell back to publicly known hardcoded constants in source code and `.env.example` when environment variables were unset, bypassing JWT-based authentication. An unauthenticated attacker knowing the default secrets can POST to `/api/graylog/invoke` (forward arbitrary commands and agent IDs to Wazuh), `/api/incidents/alerts/create/threshold`, and `/api/incidents/alerts/create/velo-sigma` (inject alerts with arbitrary customer codes). The fix enforces fail-closed behavior: webhook validators now require explicitly set environment variables and reject requests when unset, plus validates the COMMAND field against a token pattern.

Affected products

SOCFortress CoPilot prior to 0.1.76

Timeline

2026-10-30: disclosed
2026-06-23: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.