Description
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected deployments, the unauthenticated `/scoutsuite-report` `StaticFiles` mount in `backend/copilot.py` exposes the `scoutsuite-report` directory even though normal /api routes require JWT authentication. Generated HTML reports and `scoutsuite-results/scoutsuite_results_<name>.js` files disclose AWS, Azure and GCP IAM principals, resource inventories, misconfigurations and findings. Report names derive from caller-selected names with predictable defaults. During an admin- or analyst-initiated GCP scan, `backend/app/integrations/scoutsuite/routes/scoutsuite.py` saves the uploaded Google service-account JSON key into that same web-served directory. In `backend/app/integrations/scoutsuite/services/scoutsuite.py`, `generate_gcp_report_background` removes the key only after the scan finishes. Any anonymous client that can reach the host and request the file path can therefore retrieve the private key during the scan and use the service account's cloud permissions, as well as read retained cloud-security reports. Credential isolation is released in version 0.1.77; a release fully remediating the report-disclosure component has not been established.
Published: 2026-10-30
Score: 9.3 Critical
EPSS: n/a
KEV: No
Impact: Information Disclosure
Action: Assess Impact
AI Analysis

Impact

The vulnerability arises from an unauthenticated StaticFiles mount at /scoutsuite-report that serves the directory containing generated ScoutSuite reports and, during GCP scans, the uploaded service‑account JSON key. An attacker who can reach the host can fetch these files and obtain AWS, Azure, and GCP IAM principals, resource inventories, and misconfigurations. The key, retained in the web‑served directory until the scan finishes, can be used to impersonate the service account and access all cloud resources whose permissions it carries.

Affected Systems

SOCFortress CoPilot deployments running versions older than 0.1.77 are impacted. The vulnerability exists in the backend Copilot code that mounts the scoutsuite‑report directory without authentication and in the GCP integration that stores the service‑account key in the same directory during a scan.

Risk and Exploitability

The CVSS base score of 9.3 reflects a very high impact. The vulnerability does not require user interaction and can be exploited remotely without authentication. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the lack of authentication and the exposure of privileged credentials make it a severe risk. The only official mitigation is the credential‑isolation feature introduced in 0.1.77; currently no full remediation release exists.

Generated by OpenCVE AI on October 30, 2026 at 15:55 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade SOCFortress CoPilot to version 0.1.77 or later.
  • If upgrading is not immediately possible, restrict external access to the /scoutsuite-report path using firewalls or reverse proxy rules, ensuring only authenticated traffic can access it.
  • Disable the StaticFiles mount for scoutsuite-report during production, or move the directory out of the web root so it cannot be served.
  • Ensure that the GCP scan completes and deletes the service‑account key before it can be exposed; configure the integration to delete the key immediately after use or store it in a protected location.
  • Monitor network traffic for unauthorized GET requests to /scoutsuite-report and investigate any suspicious activity.

Generated by OpenCVE AI on October 30, 2026 at 15:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Socfortress
Socfortress copilot
Vendors & Products Socfortress
Socfortress copilot
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 30 Oct 2026 14:45:00 +0000

Type Values Removed Values Added
Description SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected deployments, the unauthenticated `/scoutsuite-report` `StaticFiles` mount in `backend/copilot.py` exposes the `scoutsuite-report` directory even though normal /api routes require JWT authentication. Generated HTML reports and `scoutsuite-results/scoutsuite_results_<name>.js` files disclose AWS, Azure and GCP IAM principals, resource inventories, misconfigurations and findings. Report names derive from caller-selected names with predictable defaults. During an admin- or analyst-initiated GCP scan, `backend/app/integrations/scoutsuite/routes/scoutsuite.py` saves the uploaded Google service-account JSON key into that same web-served directory. In `backend/app/integrations/scoutsuite/services/scoutsuite.py`, `generate_gcp_report_background` removes the key only after the scan finishes. Any anonymous client that can reach the host and request the file path can therefore retrieve the private key during the scan and use the service account's cloud permissions, as well as read retained cloud-security reports. Credential isolation is released in version 0.1.77; a release fully remediating the report-disclosure component has not been established.
Title SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount
Weaknesses CWE-200
CWE-306
CWE-522
CWE-552
References
Metrics cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N'}

Subscriptions

Socfortress Copilot
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-30T15:47:21.224Z

Reserved: 2026-07-10T18:59:00.046Z

Link: CVE-2026-61730

cve-icon Vulnrichment

Updated: 2026-10-30T15:47:16.905Z

cve-icon NVD

Status : Received

Published: 2026-10-30T15:16:53.223

Modified: 2026-10-30T16:17:57.870

Link: CVE-2026-61730

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T16:15:14Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-306

    Missing Authentication for Critical Function

  • CWE-522

    Insufficiently Protected Credentials

  • CWE-552

    Files or Directories Accessible to External Parties