Live › vulnerability › CVE-2026-61730
SOCFortress CoPilot serves its ScoutSuite report directory without authentication, so anyone who can reach the host can read cloud security reports. During a GCP scan it also saves the uploaded Google service-account key into that directory, letting an anonymous visitor retrieve the key and use the account's cloud permissions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Teams running self-hosted SOCFortress CoPilot with ScoutSuite GCP, AWS or Azure scans enabled, where the host is reachable by anonymous clients. Deployments behind network controls that block the /scoutsuite-report path reduce exposure, and teams that never run ScoutSuite scans are not affected by the key-saving path.
No product ranges from the sources yet.
0.1.77./scoutsuite-report/ on the host without credentials and see whether the files are listed or served.scoutsuite-results/ and scoutsuite-report directories in the web-served path.0.1.77 or later, which the source states releases credential isolation.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected deployments, the unauthenticated /scoutsuite-report StaticFiles mount in backend/copilot.py exposes the scoutsuite-report directory even though normal /api routes require JWT authentication. Generated HTML reports and scoutsuite-results/scoutsuite_results_<name>.js files disclose AWS, Azure and GCP IAM principals, resource inventories, misconfigurations and findings. Report names derive from caller-selected names with predictable defaults. During an admin- or analyst-initiated GCP scan, backend/app/integrations/scoutsuite/routes/scoutsuite.py saves the uploaded Google service-account JSON key into that same web-served directory. In backend/app/integrations/scoutsuite/services/scoutsuite.py, generate_gcp_report_background removes the key only after the scan finishes. Any anonymous client that can reach the host and request the file path can therefore retrieve the private key during the scan and use the service account's cloud permissions, as well as read retained cloud-security reports. Credential isolation is released in version 0.1.77; a release fully remediating the report-disclosure component has not been established.
This page as .md · .json · in your agent: get_signal("CVE-2026-61730")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.