What is the CVSS score of CVE-2026-42869?

CVE-2026-42869 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of SOCFortress CoPilot are affected by CVE-2026-42869?

SOCFortress CoPilot versions before 0.1.57 contain a critical authentication bypass vulnerability that allows unauthenticated attackers to forge administrator credentials and gain complete control of…. A patch is available.

How to fix or mitigate CVE-2026-42869?

Within 24 hours: Identify all deployed instances of SOCFortress CoPilot and determine active versions (check docker image tags, git history, or version endpoint). Verify whether JWT_SECRET environment variable is explicitly configured in production (if unset, default hardcoded secret applies). Within 7 days: Upgrade all affected instances to SOCFortress CoPilot version 0.1.57 or later, following the vendor's upgrade documentation. Set a cryptographically strong JWT_SECRET value unique per environment and rotate all existing JWT tokens. Within 30 days: Audit access logs for the affected systems to identify unauthorized admin token usage or configuration changes during the vulnerability window; implement JWT signing secret rotation policy and enforce environment-variable configuration validation in deployment pipelines.

SOCFortress CoPilot CVE-2026-42869

EUVD-2026-29184 CRITICAL

Improper Authentication (CWE-287)

2026-05-11 GitHub_M

Authentication Bypass Docker

10.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 11, 2026 - 20:02 EUVD

Source Code Evidence Fetched

May 11, 2026 - 19:46 vuln.today

Analysis Generated

May 11, 2026 - 19:46 vuln.today

CVE Published

May 11, 2026 - 18:39 nvd

CRITICAL 10.0

DescriptionGitHub Advisory

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.57, SOCFortress CoPilot ships a hardcoded JWT signing secret as a fallback value in backend/app/auth/utils.py:28 and ships it verbatim in .env.example. Any deployment where JWT_SECRET is not explicitly set - including the default Docker Compose setup - signs all authentication tokens with this publicly known value. An unauthenticated attacker can forge arbitrary admin-scoped JWTs and gain full control of the application and every security tool it manages without any credentials. This vulnerability is fixed in 0.1.57.

AnalysisAI

Authentication bypass in SOCFortress CoPilot versions prior to 0.1.57 allows remote unauthenticated attackers to forge admin-scoped JWT tokens and gain full control of the security operations platform. The application ships with a publicly known JWT signing secret hardcoded as a fallback value (bL4unrkoxtFs1MT6A7Ns2yMLkduyuqrkTxDV9CjlbNc=) in backend/app/auth/utils.py and .env.example. Any deployment using the default Docker Compose setup or where JWT_SECRET is not explicitly set signs all authentication tokens with this known value, enabling attackers to impersonate administrators and control every integrated security tool without credentials. CVSS 10.0 with network vector and no authentication required. Fix confirmed in version 0.1.57 via GitHub commit 4640511a0cf2e7b144a71375b5b349a8318cb186.

Technical ContextAI

JSON Web Tokens (JWT) rely on cryptographic signatures to verify authenticity and prevent tampering. The signing secret must remain confidential and unique per deployment. SOCFortress CoPilot's AuthHandler class in backend/app/auth/utils.py contained a hardcoded fallback for JWT_SECRET, identical to the default in .env.example, used when the environment variable was unset. This violates secure coding practices for secret management and maps to CWE-287 (Improper Authentication). The Docker Compose default deployment did not prompt users to change this value, leaving production systems vulnerable. The secret was used to sign JWTs for all user sessions, including admin-level authentication tokens. An attacker with knowledge of the public secret can use standard JWT libraries (PyJWT, jsonwebtoken) to forge tokens with arbitrary user IDs and admin scopes, bypassing all authentication controls. The vulnerability also affected TOTP secret encryption in backend/app/auth/services/totp.py, which derived a Fernet key from the same JWT_SECRET, potentially exposing multi-factor authentication secrets. The fix removes the hardcoded fallback and forces the application to terminate at startup if JWT_SECRET is missing or set to the known-compromised value, preventing unsafe deployments.

RemediationAI

Upgrade immediately to SOCFortress CoPilot version 0.1.57 or later, confirmed fixed in commit 4640511a0cf2e7b144a71375b5b349a8318cb186 via pull request 814 (https://github.com/socfortress/CoPilot/pull/814). The patched version refuses to start if JWT_SECRET is unset or contains the compromised default value, forcing secure configuration. After upgrading, operators must generate a unique JWT secret using openssl rand -base64 32 and set it in the JWT_SECRET environment variable before restarting. Critical: All existing JWT tokens and user sessions signed with the old secret must be invalidated immediately, as attackers may have pre-generated forged admin tokens. Review authentication logs for suspicious admin access patterns and audit all configuration changes made to integrated security tools, as attackers with forged admin JWTs could modify SIEM rules, disable monitoring, or exfiltrate security event data. If upgrade is not immediately possible, the only effective mitigation is to take the CoPilot instance offline, as network isolation or authentication proxies cannot prevent JWT forgery. Do not rely on WAF or IP restrictions - the vulnerability is in token validation logic, not network access. Partial mitigation by manually setting a unique JWT_SECRET in pre-0.1.57 versions stops new exploitation but does not invalidate previously forged tokens or address TOTP encryption using the old key, requiring immediate upgrade plus full user credential rotation.