CVE-2026-56221 Overview
CVE-2026-56221 is a SQL injection vulnerability [CWE-89] affecting Cap-go (capgo) versions prior to 12.128.2. The flaw resides in cloudflare.ts, where user-controlled values from API request bodies are interpolated directly into SQL query strings against Cloudflare Analytics Engine. The affected parameters include deviceIds, search, version_name, cursor, and actions. Authenticated users holding only read-level API key permissions can inject arbitrary SQL to access analytics data belonging to other users or applications. The vulnerability breaks tenant isolation across the multi-tenant Cap-go platform.
Critical Impact
Authenticated attackers with low-privilege API keys can read analytics data belonging to other tenants by injecting SQL through multiple request body parameters.
Affected Products
- Cap-go (capgo) versions prior to 12.128.2
- The cloudflare.ts module handling Cloudflare Analytics Engine queries
- Multi-tenant deployments exposing analytics API endpoints
Discovery Timeline
- 2026-06-22 - CVE-2026-56221 published to the National Vulnerability Database
- 2026-06-23 - Last updated in NVD database
Technical Details for CVE-2026-56221
Vulnerability Analysis
The vulnerability is a classic SQL injection (CWE-89) that arises in the analytics query path implemented in cloudflare.ts. Cap-go uses Cloudflare Analytics Engine as the backend datastore for application analytics. Query construction concatenates request body parameters into SQL strings without parameterization or input sanitization.
An authenticated user submits an API request with crafted values in deviceIds, search, version_name, cursor, or actions. These values are spliced into the final SQL statement before execution. The attacker can break out of intended query clauses and append arbitrary SQL fragments. Because Analytics Engine queries return rows across the analytics dataset, injected predicates can retrieve data scoped to other tenants.
Exploitation requires only a valid API key with read-level permissions, which lowers the barrier compared to vulnerabilities requiring administrative access.
Root Cause
The root cause is direct string interpolation of untrusted input into SQL queries. The affected code paths in cloudflare.ts neither use prepared statements nor apply allowlist validation against the parameter values supplied by the API caller. Tenant scoping is enforced inside the SQL WHERE clause itself, so injection that modifies or terminates that clause defeats the authorization boundary.
Attack Vector
The attack vector is network-based and requires authentication. An attacker obtains a read-level API key, sends a request to a vulnerable analytics endpoint, and embeds SQL syntax inside one of the five vulnerable parameters. The injected payload manipulates the WHERE clause to remove tenant filters or to introduce subqueries that enumerate identifiers and analytics records belonging to other accounts.
No synthetic exploit code is published here. Refer to the GitHub Security Advisory GHSA-f83x-p28r-pf74 and the VulnCheck Advisory on SQL Injection for technical detail.
Detection Methods for CVE-2026-56221
Indicators of Compromise
- Analytics API requests containing SQL metacharacters such as single quotes, UNION, --, or /* in the deviceIds, search, version_name, cursor, or actions fields.
- Unusually long or structurally complex values in parameters that normally hold short identifiers or version strings.
- Read-level API keys generating analytics queries that return data volumes inconsistent with their owning tenant.
Detection Strategies
- Log all request bodies sent to Cap-go analytics endpoints and scan for SQL syntax tokens within the five affected parameters.
- Compare the application or organization identifier embedded in each API key against the tenant scope of returned analytics rows.
- Alert on API keys that suddenly issue queries with significantly different parameter shapes than their historical baseline.
Monitoring Recommendations
- Forward Cap-go application logs and Cloudflare Analytics Engine query logs to a centralized analytics or SIEM platform for correlation.
- Track per-API-key query frequency and result-set size to identify enumeration behavior.
- Continuously monitor for the presence of vulnerable Cap-go versions in the software inventory using release identifiers below 12.128.2.
How to Mitigate CVE-2026-56221
Immediate Actions Required
- Upgrade Cap-go (capgo) to version 12.128.2 or later on all self-hosted deployments.
- Rotate all API keys, particularly read-level keys, that were active prior to the upgrade.
- Review analytics access logs for evidence of injected SQL in the five affected parameters and assess potential cross-tenant data exposure.
Patch Information
The maintainers released a fix in Cap-go 12.128.2. The patched code paths replace direct string interpolation in cloudflare.ts with parameterized query construction and input validation. Patch details are documented in the GitHub Security Advisory GHSA-f83x-p28r-pf74.
Workarounds
- Restrict access to analytics API endpoints behind a reverse proxy or WAF that rejects request bodies containing SQL metacharacters in the affected parameters.
- Temporarily revoke read-level API keys for tenants that do not require analytics access until the upgrade is applied.
- Enforce strict allowlists at the proxy layer for version_name, cursor, and actions values based on expected formats.
# Upgrade Cap-go to the patched release
npm install @capgo/capgo@^12.128.2
# Verify the installed version is 12.128.2 or later
npm list @capgo/capgo
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
