CVE Intelligence
Analysis AI-assisted

CVE-2026-42869: SOCFortress CoPilot: hardcoded JWT signing secret allows authentication forgery

SOCFortress CoPilot versions before 0.1.57 fall back to a hardcoded JWT signing secret when JWT_SECRET is not set, including in the default Docker Compose setup. The record states that an unauthenticated attacker could use this publicly known value to forge administrator-scoped tokens and control the application. The issue is fixed in 0.1.57, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

SOCFortress CoPilot is a security operations platform. According to the record, versions before 0.1.57 use a hardcoded fallback JWT signing secret in backend/app/auth/utils.py and repeat it in .env.example. The weakness is classified as CWE-287, Improper Authentication.

Impact

When JWT_SECRET is not explicitly set, including with the default Docker Compose setup, authentication tokens are signed with a publicly known value. The record states that an unauthenticated attacker could forge admin-scoped tokens and gain full control of the application and the security tools it manages. The CVSS 3.1 base score is 10 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Affected products and versions

  • Product: SOCFortress CoPilot.
  • Affected: versions prior to 0.1.57, as stated in the description.
  • Fixed: 0.1.57, as stated in the description and the referenced GitHub advisory.
  • The record contains no structured affected or fixed version data, so exact ranges should be confirmed in the advisory.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability is recorded as 0.00778, with a percentile of 0.54695.

Remediation and mitigation

  • Upgrade to version 0.1.57 or later.
  • Set a unique, high-entropy JWT_SECRET in every deployment before startup, and do not reuse the value shipped in .env.example.
  • After upgrading, consider rotating secrets and invalidating sessions issued while the fallback was in effect, as a precaution.
  • Limit network exposure of the management interface to trusted networks.

Detection guidance

  • Review authentication logs for administrative activity from unexpected sources or without matching user sessions.
  • Check whether deployments run with JWT_SECRET missing or set to a default value.
  • Audit configuration repositories and container environment files for the shipped example secret.

Limitations of the available information

The record has no structured affected product list, fixed version list, or KEV details beyond the listing status. The sources consulted do not state when the fallback secret was first exposed or whether any instance was attacked. Session invalidation advice is an inference, not a documented vendor requirement.

Frequently asked questions

What is the core issue in CVE-2026-42869?

Versions of SOCFortress CoPilot before 0.1.57 use a hardcoded fallback JWT signing secret when JWT_SECRET is not set. Because the value is publicly known according to the record, authentication tokens can be forged.

Which version fixes this vulnerability?

The record and the referenced GitHub advisory state that the issue is fixed in version 0.1.57. Upgrading and setting a unique JWT_SECRET is the recommended remediation.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.