PT-2026-39734 · Unknown · Socfortress Copilot

Chimppppy · Published 2026-05-11 · Updated 2026-05-12 · CVE-2026-42869

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SOCFortress CoPilot versions prior to 0.1.57

Description The application contains a hardcoded JSON Web Token (JWT) signing secret used as a fallback value in the backend/app/auth/utils.py file and the .env.example file. In deployments where the JWT SECRET variable is not explicitly configured, such as the default Docker Compose setup, the system uses this publicly known value to sign authentication tokens. This allows an unauthenticated attacker to forge admin-scoped tokens and gain full control over the application and its managed security tools.

Recommendations Update to version 0.1.57. Explicitly set the JWT SECRET variable in the environment configuration to replace the default fallback value.

Exploit

Fix

Insufficiently Protected Credentials

Using Hardcoded Credentials

Improper Authentication

Weakness Enumeration

CWE-522

CWE-798

CWE-287

Related Identifiers

CVE-2026-42869

Affected Products

Socfortress Copilot

References · 5

• 🔥 https://github.com/socfortress/CoPilot/security/advisories/GHSA-4gxj-hw3c-3x2x · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42869 · Security Note
• https://github.com/socfortress/CoPilot/commit/4640511a0cf2e7b144a71375b5b349a8318cb186 · Note
• https://github.com/socfortress/CoPilot/pull/814 · Note
• https://twitter.com/TuringCyberObs/status/2054137819300278497 · Twitter Post