CVE-2026-56248: Cap-go Capgo Backend DoS Vulnerability

CVE-2026-56248 Overview

CVE-2026-56248 is an unauthenticated denial-of-service vulnerability in Cap-go capgo (capgo-backend) before version 12.128.12. The flaw resides in the Row-Level Security (RLS) policy applied to the public.audit_logs table when exposed through the Supabase PostgREST API. The PostgreSQL query planner evaluates expensive logic before RLS rejection, so unfiltered queries using the public anon key consistently trigger statement timeouts (PostgREST error 57014). Concurrent requests exhaust database resources and cause cascading HTTP 500 failures on unrelated endpoints such as /orgs. The vulnerability is categorized under CWE-400 Uncontrolled Resource Consumption.

Critical Impact
Unauthenticated attackers can exhaust database resources and produce an application-wide outage by repeatedly querying the audit_logs endpoint.

Affected Products

Cap-go capgo (capgo-backend) versions before 12.128.12
Supabase PostgREST-exposed public.audit_logs endpoint
Deployments relying on the public anon key for client access

Discovery Timeline

2026-06-23 - CVE-2026-56248 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-56248

Vulnerability Analysis

The vulnerability stems from how PostgreSQL evaluates queries against tables protected by Row-Level Security. When a client issues a request to public.audit_logs through the Supabase PostgREST API using the anonymous key, the query planner constructs an execution plan that includes joins and filtering logic. This costly logic executes before the RLS policy rejects the unauthorized request. The result is a statement timeout returned as PostgREST error 57014.

Under concurrent request load, each pending query consumes a database connection and CPU cycles until the timeout fires. The connection pool saturates quickly. Unrelated endpoints such as /orgs then begin returning HTTP 500 errors because they cannot acquire database connections. The outcome is an application-layer denial of service triggered without authentication.

The EPSS score is 0.359% at the 27.7 percentile, reflecting low predicted exploitation activity at publication time. However, the lack of authentication requirements lowers the practical barrier to abuse.

Root Cause

The root cause is an RLS policy on audit_logs that performs expensive evaluation rather than short-circuiting on the anonymous role. PostgreSQL applies RLS as a query rewrite, meaning the optimizer integrates policy predicates into the plan. When predicates require joins or subqueries to determine access, the planner executes them before producing the empty result set that RLS would otherwise enforce.

Attack Vector

An unauthenticated remote attacker sends repeated GET requests to the PostgREST endpoint backing public.audit_logs using the public anon key. No filters are applied, forcing the planner to consider the full table. The attacker increases concurrency until statement timeouts trigger across the connection pool. Subsequent legitimate traffic to other endpoints fails due to resource exhaustion.

The vulnerability requires no privileges, no user interaction, and is exploitable over the network. See the GitHub Security Advisory and the VulnCheck Advisory on Capgo for further technical context.

Detection Methods for CVE-2026-56248

Indicators of Compromise

Repeated PostgREST error 57014 (statement timeout) entries in PostgreSQL logs for queries targeting public.audit_logs
HTTP 500 response bursts on unrelated endpoints such as /orgs during periods of elevated audit_logs traffic
Elevated request volume to the audit_logs endpoint originating from a small number of source IP addresses using the anon key

Detection Strategies

Monitor PostgreSQL pg_stat_statements for high mean execution time queries against audit_logs originating from the anon role
Alert on sustained connection pool saturation correlated with anon-key requests to PostgREST
Correlate web tier 500 errors with database timeout events to identify cascading failures

Monitoring Recommendations

Enable PostgREST request logging and forward logs to a centralized analytics platform for anomaly detection
Set thresholds on statement timeout counts per minute per endpoint
Track anon-key request rates against audit_logs and trigger alerts when rates exceed baseline

How to Mitigate CVE-2026-56248

Immediate Actions Required

Upgrade capgo-backend to version 12.128.12 or later
Restrict anon-key access to the audit_logs table at the PostgREST schema level
Apply a restrictive RLS policy that returns false immediately for the anonymous role before any join logic executes

Patch Information

The vendor fixed this issue in capgo-backend version 12.128.12. Refer to the GitHub Security Advisory GHSA-5vgv-rqj5-5748 for patch details and upgrade instructions.

Workarounds

Revoke SELECT privileges on public.audit_logs from the anon role until the patch is applied
Deploy a reverse proxy or web application firewall rule to rate-limit or block unauthenticated requests to the audit_logs PostgREST path
Lower the PostgreSQL statement_timeout for the anon role to reduce per-request resource consumption

bash

# Configuration example - revoke anon access and add a short-circuit RLS policy
REVOKE SELECT ON public.audit_logs FROM anon;

CREATE POLICY audit_logs_deny_anon ON public.audit_logs
  AS RESTRICTIVE
  FOR SELECT
  TO anon
  USING (false);

ALTER ROLE anon SET statement_timeout = '2s';