CVE-2026-61729: SOCFortress CoPilot: Hardcoded Default Header Secret - Unauthenticated Active-Response Invocation and Alert Injection

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, verifygraylogheader in backend/app/activeresponse/routes/graylog.py and verifyvelociraptorheader in backend/app/incidents/routes/incidentalert.py authenticate webhooks against GRAYLOGAPIHEADERVALUE and VELOCIRAPTORAPIHEADERVALUE with the same publicly hardcoded fallback. The same default is shipped in .env.example. Deployments that leave either setting unset or unchanged permit an anonymous caller with the known header value to bypass the JWT authentication required by normal APIs. POST /api/graylog/invoke forwards attacker-selected COMMAND, ACTION, VALUE and AGENTID to the configured Wazuh manager without the command-enum validation of the authenticated invocation route, allowing active-response scripts to disrupt endpoints and manipulate defensive controls. POST /api/incidents/alerts/create/threshold and POST /api/incidents/alerts/create/velo-sigma accept forged alerts for arbitrary customercode values and drive attacker-controlled OpenSearch queries. Active-response delivery requires a configured reachable Wazuh manager. Deployments with independently changed header secrets are not subject to this default-secret bypass. This issue is fixed in version 0.1.76.