CVE-2026-56243 Overview
CVE-2026-56243 is an authentication bypass vulnerability in Capgo versions before 12.128.2. The PostgREST/Row Level Security (RLS) plane accepts plaintext API keys submitted through the capgkey header, even when the enforce_hashed_api_keys setting is enabled. This breaks the organization-level hashed-key enforcement control, allowing attackers with a valid plaintext API key to access protected resources directly through the PostgREST/RLS plane. The flaw is categorized under [CWE-288] (Authentication Bypass Using an Alternate Path or Channel).
Critical Impact
Attackers possessing plaintext API keys can bypass hashed-key enforcement and access protected Capgo resources through the PostgREST/RLS plane.
Affected Products
- Capgo versions prior to 12.128.2
- Capgo PostgREST/RLS plane component
- Self-hosted Capgo deployments using enforce_hashed_api_keys
Discovery Timeline
- 2026-06-23 - CVE-2026-56243 published to NVD
- 2026-06-23 - Last updated in NVD database
Technical Details for CVE-2026-56243
Vulnerability Analysis
The vulnerability resides in how the Capgo backend validates API keys submitted via the capgkey header. Capgo provides an enforce_hashed_api_keys configuration intended to require API keys to be hashed before storage and validation. The PostgREST/RLS plane does not honor this enforcement consistently. Plaintext API keys passed in the capgkey header are accepted as valid credentials, bypassing the hashed-key enforcement boundary established at the organization level. Attackers who obtain a plaintext key — through log exposure, leaked configuration, intercepted traffic, or insider access — can authenticate directly to PostgREST endpoints and operate within the database's RLS context. This affects confidentiality and integrity of organization-scoped data accessible through the API.
Root Cause
The root cause is an inconsistent authentication path. The PostgREST/RLS plane implements a credential acceptance path that does not enforce the same hashed-key policy applied elsewhere in Capgo. The enforce_hashed_api_keys flag is effectively ignored on this code path, creating an alternate channel that satisfies [CWE-288].
Attack Vector
The attack vector is network-based and requires low privileges — the attacker must possess a valid plaintext API key. No user interaction is needed. The attacker sends HTTP requests to the PostgREST/RLS endpoint with the plaintext key in the capgkey header, and the server processes the request as authenticated, granting access to any resources the key's organization context permits.
No verified proof-of-concept code has been published. Refer to the GitHub Security Advisory and the VulnCheck Advisory on Capgo Bypass for additional technical details.
Detection Methods for CVE-2026-56243
Indicators of Compromise
- HTTP requests to PostgREST endpoints containing the capgkey header with values matching plaintext key formats rather than hashed values.
- PostgREST/RLS access logs showing authenticated activity from API keys that should have been rejected under enforce_hashed_api_keys.
- Unexpected cross-organization data access patterns originating from a single API key.
Detection Strategies
- Inspect reverse proxy or ingress logs for requests carrying the capgkey header and correlate against the expected hashed-key format.
- Audit Capgo database query logs for PostgREST sessions that succeeded despite organization-level hashed-key enforcement being enabled.
- Compare authentication events between the application plane and the PostgREST/RLS plane to identify divergent acceptance behavior.
Monitoring Recommendations
- Forward PostgREST, application server, and reverse proxy logs to a centralized analytics platform for correlation.
- Alert on any successful authentication using a key value that does not match the configured hash format.
- Track API key usage volumes and flag spikes that could indicate credential abuse following the bypass.
How to Mitigate CVE-2026-56243
Immediate Actions Required
- Upgrade Capgo to version 12.128.2 or later, where the PostgREST/RLS plane honors enforce_hashed_api_keys.
- Rotate all API keys, particularly any keys that may have been stored or transmitted in plaintext form.
- Audit recent PostgREST/RLS access logs for evidence of plaintext-key authentication and investigate any anomalies.
Patch Information
The maintainers fixed the issue in Capgo 12.128.2. The patch ensures the PostgREST/RLS plane enforces the same hashed-key requirement as other authentication paths when enforce_hashed_api_keys is enabled. See the GitHub Security Advisory for fix details and upgrade guidance.
Workarounds
- Restrict network access to the PostgREST/RLS endpoint to trusted internal services only, preventing untrusted clients from submitting capgkey headers.
- Place a reverse proxy in front of PostgREST that rejects requests where the capgkey header does not match the expected hashed-key pattern.
- Disable or revoke any API keys not strictly required until the upgrade can be deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
