{"metadata": {"vulnerability": "CVE-2026-61729", "count": 10, "kinds": {"milestone": 3, "sighting": 4, "kev": 0, "other": 3}}, "data": [{"timestamp": "2026-07-10T18:59:00.046Z", "date_only": false, "value": "2026-07-10T18:59:00.046Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-61729", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-30T14:24:04.762Z", "date_only": false, "value": "2026-10-30T14:24:04.762Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61729", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T14:24:04.762Z", "date_only": false, "value": "2026-10-30T14:24:04.762Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-61729", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-30T14:24:04.762Z", "date_only": false, "value": "2026-10-30T14:24:04.762Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-61729", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-30T14:46:55.909Z", "date_only": false, "value": "2026-10-30T14:46:55.909705Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117530402185736002", "record": "CVE-2026-61729", "field": "creation_timestamp", "uuid": "02bf4b5f-b38e-44cd-98ef-e558e24228b3", "content": "CVE-2026-61729 SOCFortress CoPilot: Hardcoded Default Header Secret - Unauthenticated Active-Response Invocation and Alert Injection SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, `verify_graylog_header` in `backend/app/active_response/routes/graylog.py` and `verify_velociraptor_header` in `backend/app/incidents/routes/incident_alert.py` authenticate webhooks against `GRAYLOG_API_HEADER_VALUE` and `VELOCIRAPTOR_API_HEADER_VALUE` with the same publicly hardcoded fallback. The same default is shipped in `.env.example`. Deployments that leave either setting unset or unchanged permit an anonymous caller with the known header value to bypass the JWT authentication required by normal APIs. `POST /api/graylog/invoke` forwards attacker-selected `COMMAND`, `ACTION`, `VALUE` and `AGENT_ID` to the configured Wazuh manager without the command-enum validation of the authenticated invocation route, allowing active-response scripts to disrupt endpoints and manipulate defensive controls. `POST /api/incidents/alerts/create/threshold` and `POST /api/incidents/alerts/create/velo-sigma` accept forged alerts for arbitrary `customer_code` values and drive attacker-controlled OpenSearch queries. Active-response delivery requires a configured reachable Wazuh manager. Deployments with independently changed header secrets are not subject to this default-secret bypass. This issue is fixed in version 0.1.76.\nhttps://www.cve.org/CVERecord?id=CVE-2026-61729https://github.com/socfortress/CoPilot/security/advisories/GHSA-x8gc-f8p4-frc2https://github.com/socfortress/CoPilot/pull/939https://github.com/socfortress/CoPilot/commit/1b2c3f97243988301285b395ce4239769c66bd9ehttps://github.com/socfortress/CoPilot/tree/v0.1.76#socfortress #CoPilot#CVE_2026_61729#bot", "url": "https://infosec.exchange/users/cve/statuses/117530402185736002"}, {"timestamp": "2026-10-30T15:16:53.083Z", "date_only": false, "value": "2026-10-30T15:16:53.083", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61729", "record": "FKIE_CVE-2026-61729", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T16:08:12.226Z", "date_only": false, "value": "2026-10-30T16:08:12.226062Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mz462fpf6t2w", "record": "CVE-2026-61729", "field": "creation_timestamp", "uuid": "cb6e93f4-3ef4-4712-b3ba-b87b3b0daea4", "content": "\ud83d\udea8 CVE-2026-61729 \u2014 CVSS 9.4 CRITICAL\n\nSOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Pri...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-61729\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mz462fpf6t2w"}, {"timestamp": "2026-10-30T17:13:54.187Z", "date_only": false, "value": "2026-10-30T17:13:54.187", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-61729", "record": "FKIE_CVE-2026-61729", "field": "lastModified"}, {"timestamp": "2026-10-30T18:03:04.435Z", "date_only": false, "value": "2026-10-30T18:03:04.435588Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/33ntb6fa6k2vp", "record": "CVE-2026-61729", "field": "creation_timestamp", "uuid": "16c83e4e-02e2-4f16-a1bf-28120800c1d0", "content": "\ud83d\udea8 CVE-2026-61729\nAffected product: see description\nCVSS 9.4 / KEV: No\nTL;DR: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, `verify_graylog_he\u2026\nhttps://cvesentinel.com/report/CVE-2026-61729\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/33ntb6fa6k2vp"}, {"timestamp": "2026-10-30T20:10:05.286Z", "date_only": false, "value": "2026-10-30T20:10:05.286580Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mz4lkwgvqv2p", "record": "CVE-2026-61729", "field": "creation_timestamp", "uuid": "5264d0c9-409d-4c88-b756-00569db1456f", "content": "CVE-2026-61729 - copilot\nVersions of SOCFortress CoPilot before 0.1.76 ship with a default secret key that is publicly known. If the default is not changed, anyone can call the API and issue commands\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#copilot #socfortress #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mz4lkwgvqv2p"}], "metrics": {"as_of": "2026-10-31T10:32:14.670Z", "anchors": {"origin": {"timestamp": "2026-10-30T14:24:04.762Z", "date_only": false, "value": "2026-10-30T14:24:04.762Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61729", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-30T14:24:04.762Z", "date_only": false, "value": "2026-10-30T14:24:04.762Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61729", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 72489.908931, "hours": 20.136085814166666, "days": 0.8390035755902777, "min_seconds": 72489.908931, "max_seconds": 72489.908931, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-30T14:24:04.762Z", "date_only": false, "value": "2026-10-30T14:24:04.762Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-61729", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-31T10:32:14.670Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}