SOCFortress CoPilot EUVD-2026-113994

Exploitable when GRAYLOG_API_HEADER_VALUE and/or VELOCIRAPTOR_API_HEADER_VALUE are left unset or unchanged from the default shipped in .env.example, because both validators fall back to the public constant ab73de7a-6f61-4dde-87cd-3af5175a7281; the attacker simply sends that value in the Graylog (or Velociraptor) request header to pass the gate with no JWT. For the active-response impact on endpoints (POST /api/graylog/invoke), a configured and reachable Wazuh manager must exist - without it the forwarded PUT fails. Unauthenticated alert injection via POST /api/incidents/alerts/create/threshold and /velo-sigma requires no such backend and succeeds directly (HTTP 200). LIMITING FACTORS: deployments that independently changed both header secrets are NOT subject to this default-secret bypass; endpoint-disruption severity depends on a live Wazuh manager and valid agent IDs.

The signals are largely consistent and point to a genuine priority for anyone actually running SOCFortress CoPilot. The CVSS 9.4 vector (AV:N/AC:L/PR:N/UI:N) is credible: the gating secret is a constant hardcoded in the public source and shipped in .env.example, so a default deployment is effectively unauthenticated over the network - PR:N is justified not by a weak password but by a publicly known value. The vuln.today Decision label is act_now, and the GHSA advisory includes a reporter-confirmed, live reproduction, so this is not a theoretical high-CVSS finding. However, no CISA KEV listing and no EPSS score were supplied, so there is no evidence of observed in-the-wild exploitation - the exploitation signal rests on the published PoC, not telemetry. Two caveats temper the raw score: (1) the CVSS confidentiality metric is only C:L, and the real severity is the integrity/availability impact on defensive tooling (active-response control plane and SOC alert pipeline), which the I:H/A:H metrics capture; (2) the most damaging effect - pushing active-response commands to endpoints - is conditioned on a configured, reachable Wazuh manager (the advisory notes the lab call returned 500 only because the manager was unreachable), whereas unauthenticated alert injection succeeded unconditionally (HTTP 200). Prevalence is the main down-weighting factor: CoPilot is a niche open-source SOC platform, so the aggregate exposure is far smaller than the 9.4 suggests. Net: treat as urgent for CoPilot operators that never changed both header secrets; broad internet-wide mass exploitation is less likely given the limited footprint.

A remote, unauthenticated attacker locates an internet-reachable CoPilot backend and sends POST /api/graylog/invoke carrying the publicly known default Graylog header value, bypassing the JWT required by every normal API. They supply attacker-chosen COMMAND/ACTION/VALUE/AGENT_ID that CoPilot forwards to the configured Wazuh manager to trigger active-response (e.g. DNS sinkhole or firewall block) on any agent, or forge SOC alerts for an arbitrary customer_code via the threshold/velo-sigma routes. A reporter-confirmed PoC with working curl commands exists in the GHSA advisory, demonstrated live against the official copilot-backend:latest image.