CVE-2026-61739: SOCFortress CoPilot authorization bypass in Velociraptor Sigma exclusion endpoints

CVE-2026-61739 · Severity: high · CVSS 7.5 · Published 2026-10-30

SOCFortress CoPilot is a security operations platform that centralizes monitoring and incident management. The Velociraptor Sigma exclusion-management feature lacks proper authorization checks, allowing unauthenticated or low-privilege attackers to create, modify, or delete alert suppression rules. This permits attackers to suppress security detections platform-wide or enumerate sensitive detection-tuning data across all customer tenants.

Technologies: SOCFortress CoPilot. Vendors: SOCFortress.

Quick answers

Is CVE-2026-61739 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-61739 being exploited in the wild.
How severe is CVE-2026-61739?
High severity, with a CVSS score of 7.5, published 30 October 2026.
Which products and versions are affected?
SOCFortress CoPilot prior to 0.1.77.
Is there a fix for CVE-2026-61739?
Yes: fixed in 0.1.77. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61739 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-61739?
Check whether you run SOCFortress CoPilot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 0.1.77

Technical details

The vulnerability stems from missing role and tenant authorization checks in the Velociraptor Sigma exclusion endpoints (`POST /api/incidents/alerts/create/velo-sigma/exclusion` and related routes). The authentication dependency `return_username_for_logging` passes through invalid or expired token strings without rejecting the request, and `get_current_user` checks lack role-based access controls. Attackers can suppress alerts via channel, title, or field matching; a null `customer_code` applies rules across all tenants, and low-privilege accounts can enumerate and modify any exclusion.

Affected products

  • SOCFortress CoPilot prior to 0.1.77

Timeline

  • 2026-10-30: disclosed
  • 2026-10-30: patched: version 0.1.77

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.