CVE-2026-56280

Cap-go before 12.128.2 contains a privilege inversion vulnerability in GET /build/logs/:jobId that allows read-only API key holders to cancel running native builds. The endpoint registers an abort listener on the SSE stream that unconditionally invokes cancelBuildOnDisconnect() using the privileged server-side BUILDER_API_KEY when clients disconnect, bypassing the app.build_native permission check required by the explicit POST /build/cancel/:jobId endpoint. Attackers with read-only API keys can repeatedly disrupt native build operations and CI/CD workflows by opening the log stream and dropping the connection.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/Cap-go/capgo/security/advisories/GHSA-95g7-xwwx-j737
https://www.vulncheck.com/advisories/cap-go-privilege-inversion-in-build-log-stream-via-sse-disconnect
https://github.com/Cap-go/capgo/security/advisories/GHSA-95g7-xwwx-j737

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Cap-go anterior a 12.128.2 contiene una vulnerabilidad de inversión de privilegios en GET /build/logs/:jobId que permite a los titulares de claves de API de solo lectura cancelar compilaciones nativas en ejecución. El endpoint registra un oyente de aborto en el flujo SSE que invoca incondicionalmente cancelBuildOnDisconnect() utilizando la BUILDER_API_KEY privilegiada del lado del servidor cuando los clientes se desconectan, eludiendo la verificación de permisos app.build_native requerida por el endpoint explícito POST /build/cancel/:jobId. Los atacantes con claves de API de solo lectura pueden interrumpir repetidamente las operaciones de compilación nativas y los flujos de trabajo de CI/CD abriendo el flujo de registros y soltando la conexión.

Information

Published : 2026-06-22 22:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-56280

Mitre link : CVE-2026-56280

CVE.ORG link : CVE-2026-56280

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-56280", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56280", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-24T18:04:44.259323Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Cap-go", "product": "capgo", "versions": [{"status": "affected", "version": "0", "lessThan": "12.128.2", "versionType": "semver"}, {"status": "unaffected", "version": "12.128.2", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-22T22:16:51.197", "references": [{"url": "https://github.com/Cap-go/capgo/security/advisories/GHSA-95g7-xwwx-j737", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/cap-go-privilege-inversion-in-build-log-stream-via-sse-disconnect", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/Cap-go/capgo/security/advisories/GHSA-95g7-xwwx-j737", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Cap-go before 12.128.2 contains a privilege inversion vulnerability in GET /build/logs/:jobId that allows read-only API key holders to cancel running native builds. The endpoint registers an abort listener on the SSE stream that unconditionally invokes cancelBuildOnDisconnect() using the privileged server-side BUILDER_API_KEY when clients disconnect, bypassing the app.build_native permission check required by the explicit POST /build/cancel/:jobId endpoint. Attackers with read-only API keys can repeatedly disrupt native build operations and CI/CD workflows by opening the log stream and dropping the connection."}, {"lang": "es", "value": "Cap-go anterior a 12.128.2 contiene una vulnerabilidad de inversi\u00f3n de privilegios en GET /build/logs/:jobId que permite a los titulares de claves de API de solo lectura cancelar compilaciones nativas en ejecuci\u00f3n. El endpoint registra un oyente de aborto en el flujo SSE que invoca incondicionalmente cancelBuildOnDisconnect() utilizando la BUILDER_API_KEY privilegiada del lado del servidor cuando los clientes se desconectan, eludiendo la verificaci\u00f3n de permisos app.build_native requerida por el endpoint expl\u00edcito POST /build/cancel/:jobId. Los atacantes con claves de API de solo lectura pueden interrumpir repetidamente las operaciones de compilaci\u00f3n nativas y los flujos de trabajo de CI/CD abriendo el flujo de registros y soltando la conexi\u00f3n."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "disclosure@vulncheck.com"}