Riskcovery

CVE-2026-42869

SOCFortress CoPilot: Hardcoded JWT secret allows unauthenticated full admin compromise and lateral movement into all integrated SOC tools

State
Published
Severity
10.0 Critical
Published
May 11, 2026
Updated
May 12, 2026
Reserved
Apr 30, 2026

Read the record on cve.org

Description

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.57, SOCFortress CoPilot ships a hardcoded JWT signing secret as a fallback value in backend/app/auth/utils.py:28 and ships it verbatim in .env.example. Any deployment where JWT_SECRET is not explicitly set — including the default Docker Compose setup — signs all authentication tokens with this publicly known value. An unauthenticated attacker can forge arbitrary admin-scoped JWTs and gain full control of the application and every security tool it manages without any credentials. This vulnerability is fixed in 0.1.57.

Scores

CVSSScoreVectorSource
3.110.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HGitHub_M

Weaknesses

  • CWE-287 Improper Authentication
  • CWE-522 Insufficiently Protected Credentials
  • CWE-798 Use of Hard-coded Credentials

Affected Products

ProductVersions
CoPilotsocfortress
  • < 0.1.57Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.