Live › vulnerability › CVE-2026-61729
SOCFortress CoPilot ships the same hardcoded fallback header value for its Graylog and Velociraptor webhooks, and the `.env.example` file contains it. An anonymous caller who sends that known value can skip the JWT login, forge alerts for any customer, and send attacker-chosen active-response commands to a configured Wazuh manager.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Deployments that leave the Graylog or Velociraptor header secret unset or at the value shipped in .env.example are exposed, because the webhook routes accept that public value in place of login. Deployments that changed both header secrets to independent values are not affected by this bypass. Active-response command delivery additionally requires a reachable Wazuh manager.
No product ranges from the sources yet.
GRAYLOG_API_HEADER_VALUE and VELOCIRAPTOR_API_HEADER_VALUE are unset or still equal the value in .env.example.0.1.76.0.1.76 or later.GRAYLOG_API_HEADER_VALUE and VELOCIRAPTOR_API_HEADER_VALUE to independent secrets that differ from the shipped default.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, verify_graylog_header in backend/app/active_response/routes/graylog.py and verify_velociraptor_header in backend/app/incidents/routes/incident_alert.py authenticate webhooks against GRAYLOG_API_HEADER_VALUE and VELOCIRAPTOR_API_HEADER_VALUE with the same publicly hardcoded fallback. The same default is shipped in .env.example. Deployments that leave either setting unset or unchanged permit an anonymous caller with the known header value to bypass the JWT authentication required by normal APIs. POST /api/graylog/invoke forwards attacker-selected COMMAND, ACTION, VALUE and AGENT_ID to the configured Wazuh manager without the command-enum validation of the authenticated invocation route, allowing active-response scripts to disrupt endpoints and manipulate defensive controls. POST /api/incidents/alerts/create/threshold and POST /api/incidents/alerts/create/velo-sigma accept forged alerts for arbitrary customer_code values and drive attacker-controlled OpenSearch queries. Active-response delivery requires a configured reachable Wazuh manager. Deployments with independently changed header secrets are not subject to this default-secret bypass. This issue is fixed in version 0.1.76.
This page as .md · .json · in your agent: get_signal("CVE-2026-61729")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.