CVE-2026-42869

{"id": "CVE-2026-42869", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42869", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-12T13:27:13.898141Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "socfortress", "product": "CoPilot", "versions": [{"status": "affected", "version": "< 0.1.57"}]}]}], "published": "2026-05-11T20:25:43.347", "references": [{"url": "https://github.com/socfortress/CoPilot/commit/4640511a0cf2e7b144a71375b5b349a8318cb186", "source": "security-advisories@github.com"}, {"url": "https://github.com/socfortress/CoPilot/pull/814", "source": "security-advisories@github.com"}, {"url": "https://github.com/socfortress/CoPilot/security/advisories/GHSA-4gxj-hw3c-3x2x", "source": "security-advisories@github.com"}, {"url": "https://github.com/socfortress/CoPilot/security/advisories/GHSA-4gxj-hw3c-3x2x", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-522"}, {"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.57, SOCFortress CoPilot ships a hardcoded JWT signing secret as a fallback value in backend/app/auth/utils.py:28 and ships it verbatim in .env.example. Any deployment where JWT_SECRET is not explicitly set \u2014 including the default Docker Compose setup \u2014 signs all authentication tokens with this publicly known value. An unauthenticated attacker can forge arbitrary admin-scoped JWTs and gain full control of the application and every security tool it manages without any credentials. This vulnerability is fixed in 0.1.57."}, {"lang": "es", "value": "SOCFortress CoPilot se centra en proporcionar un \u00fanico panel de control para todas sus necesidades de operaciones de seguridad. Antes de la versi\u00f3n 0.1.57, SOCFortress CoPilot distribuye un secreto de firma JWT codificado de forma r\u00edgida como valor de reserva en backend/app/auth/utils.py:28 y lo distribuye textualmente en .env.example. Cualquier despliegue donde JWT_SECRET no se establece expl\u00edcitamente -incluyendo la configuraci\u00f3n predeterminada de Docker Compose- firma todos los tokens de autenticaci\u00f3n con este valor conocido p\u00fablicamente. Un atacante no autenticado puede falsificar JWTs arbitrarios con alcance de administrador y obtener control total de la aplicaci\u00f3n y de cada herramienta de seguridad que gestiona sin ninguna credencial. Esta vulnerabilidad se corrige en la versi\u00f3n 0.1.57."}], "lastModified": "2026-10-26T18:10:00.173", "sourceIdentifier": "security-advisories@github.com"}