{"id":"CVE-2026-61729","kind":"vulnerability","aliases":["CVE-2026-61729"],"related":[],"title":"SOCFortress CoPilot: hardcoded webhook secret lets anonymous callers bypass authentication","description":"SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, `verify_graylog_header` in `backend/app/active_response/routes/graylog.py` and `verify_velociraptor_header` in `backend/app/incidents/routes/incident_alert.py` authenticate webhooks against `GRAYLOG_API_HEADER_VALUE` and `VELOCIRAPTOR_API_HEADER_VALUE` with the same publicly hardcoded fallback. The same default is shipped in `.env.example`. Deployments that leave either setting unset or unchanged permit an anonymous caller with the known header value to bypass the JWT authentication required by normal APIs. `POST /api/graylog/invoke` forwards attacker-selected `COMMAND`, `ACTION`, `VALUE` and `AGENT_ID` to the configured Wazuh manager without the command-enum validation of the authenticated invocation route, allowing active-response scripts to disrupt endpoints and manipulate defensive controls. `POST /api/incidents/alerts/create/threshold` and `POST /api/incidents/alerts/create/velo-sigma` accept forged alerts for arbitrary `customer_code` values and drive attacker-controlled OpenSearch queries. Active-response delivery requires a configured reachable Wazuh manager. Deployments with independently changed header secrets are not subject to this default-secret bypass. This issue is fixed in version 0.1.76.","summary":"SOCFortress CoPilot ships the same hardcoded fallback header value for its Graylog and Velociraptor webhooks, and the `.env.example` file contains it. An anonymous caller who sends that known value can skip the JWT login, forge alerts for any customer, and send attacker-chosen active-response commands to a configured Wazuh manager.","severity":"critical","cvss":9.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["graylog","other","self-hosted","socfortress-copilot","velociraptor","wazuh"],"not_affected_if":["changed-header-secrets","no-wazuh-manager"],"how_to_check":"- Check whether `GRAYLOG_API_HEADER_VALUE` and `VELOCIRAPTOR_API_HEADER_VALUE` are unset or still equal the value in `.env.example`.\n- Check the installed CoPilot version against `0.1.76`.\n- Check whether a Wazuh manager is configured for active response.","fix":"- Upgrade SOCFortress CoPilot to `0.1.76` or later.\n- Set `GRAYLOG_API_HEADER_VALUE` and `VELOCIRAPTOR_API_HEADER_VALUE` to independent secrets that differ from the shipped default.","status":"open","published_at":"2026-10-30T15:16:53+00:00","first_seen_at":"2026-10-30T15:31:11+00:00","triaged_at":"2026-10-30T15:33:11+00:00","updated_at":"2026-10-30T15:33:11+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-30T15:33:11Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade SOCFortress CoPilot to `0.1.76` or later.\n- Set `GRAYLOG_API_HEADER_VALUE` and `VELOCIRAPTOR_API_HEADER_VALUE` to independent secrets that differ from the shipped default.","reach":"network","title":"SOCFortress CoPilot: hardcoded webhook secret lets anonymous callers bypass authentication","impact":"high","summary":"SOCFortress CoPilot ships the same hardcoded fallback header value for its Graylog and Velociraptor webhooks, and the `.env.example` file contains it. An anonymous caller who sends that known value can skip the JWT login, forge alerts for any customer, and send attacker-chosen active-response commands to a configured Wazuh manager.","audience":"businesses","category":"other","nicknames":[],"who_cares":["socfortress-copilot","graylog","velociraptor","wazuh","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Anonymous attackers can run Wazuh active-response commands and forge alerts","analyst_note":"","how_to_check":"- Check whether `GRAYLOG_API_HEADER_VALUE` and `VELOCIRAPTOR_API_HEADER_VALUE` are unset or still equal the value in `.env.example`.\n- Check the installed CoPilot version against `0.1.76`.\n- Check whether a Wazuh manager is configured for active response.","plain_action":"","needs_analyst":false,"not_affected_if":["changed-header-secrets","no-wazuh-manager"],"who_is_affected":"Deployments that leave the Graylog or Velociraptor header secret unset or at the value shipped in `.env.example` are exposed, because the webhook routes accept that public value in place of login. Deployments that changed both header secrets to independent values are not affected by this bypass. Active-response command delivery additionally requires a reachable Wazuh manager.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.001402,"input_tokens":4527,"output_tokens":1898,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-61729':13A,16A '/api/graylog/invoke':162C '/api/incidents/alerts/create/threshold':202C '/api/incidents/alerts/create/velo-sigma':205C '0.1.76':98C,252C 'accept':206C 'action':168C 'activ':72B,191C,222C 'active-respons':71B,190C,221C 'agent':171C 'alert':62B,208C 'allow':189C 'anonym':7A,49B,145C 'api':114C,119C,160C 'arbitrari':210C 'attack':69B,165C,217C 'attacker-chosen':68B 'attacker-control':216C 'attacker-select':164C 'authent':10A,110C,156C,186C 'backend/app/active_response/routes/graylog.py':103C 'backend/app/incidents/routes/incident_alert.py':109C 'bypass':9A,153C,245C 'caller':8A,50B,146C 'chang':234C 'chosen':70B 'code':212C 'command':74B,167C,181C 'command-enum':180C 'configur':77B,175C,227C 'contain':46B 'control':200C,218C 'copilot':2A,24B,28B,81C 'custom':65B,211C 'cve':11A,14A 'default':130C,243C 'default-secret':242C 'defens':199C 'deliveri':224C 'deploy':135C,231C 'disrupt':195C 'drive':215C 'either':138C 'endpoint':196C 'enum':182C 'env.example':44B,134C 'fallback':33B,127C 'file':45B 'fix':249C 'focus':82C 'forg':61B,207C 'forward':163C 'glass':89C 'graylog':17B,38B,100C,113C 'hardcod':3A,32B,126C 'header':34B,101C,107C,115C,120C,150C,235C 'host':21B 'id':172C 'independ':233C 'invoc':187C 'issu':247C 'jwt':59B,155C 'known':54B,149C 'leav':137C 'let':6A 'login':60B 'manag':79B,177C,230C 'manipul':198C 'need':95C 'normal':159C 'opensearch':219C 'oper':94C 'pane':87C 'permit':143C 'post':161C,201C,204C 'prior':96C 'provid':84C 'public':125C 'queri':220C 'reachabl':228C 'requir':157C,225C 'respons':73B,192C,223C 'rout':188C 'script':193C 'secret':5A,236C,244C 'secur':93C 'select':166C 'self':20B 'self-host':19B 'send':52B,67B 'set':139C 'ship':29B,132C 'singl':86C 'skip':57B 'socfortress':1A,23B,27B,80C 'socfortress-copilot':22B 'subject':239C 'unchang':142C 'unset':140C 'valid':183C 'valu':35B,55B,116C,121C,151C,169C,213C 'velociraptor':25B,40B,106C,118C 'verifi':99C,105C 'version':251C 'wazuh':26B,78B,176C,229C 'webhook':4A,41B,111C 'without':178C","nicknames":[],"mitigations":[],"who_affected":"Deployments that leave the Graylog or Velociraptor header secret unset or at the value shipped in `.env.example` are exposed, because the webhook routes accept that public value in place of login. Deployments that changed both header secrets to independent values are not affected by this bypass. Active-response command delivery additionally requires a reachable Wazuh manager.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T15:16:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61729","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61729","severity":null,"published_at":"2026-10-30T15:16:53+00:00","modified_at":"2026-10-30T15:16:53+00:00","first_seen_at":"2026-10-30T15:31:11+00:00","fetched_at":"2026-10-30T15:31:11+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}