CVE-2026-56280 Overview
CVE-2026-56280 is a privilege inversion vulnerability in Cap-go (capgo) versions before 12.128.2. The flaw resides in the GET /build/logs/:jobId endpoint, which streams native build logs over Server-Sent Events (SSE). When a client disconnects, the endpoint unconditionally invokes cancelBuildOnDisconnect() using the privileged server-side BUILDER_API_KEY. This bypasses the app.build_native permission check enforced by the explicit POST /build/cancel/:jobId endpoint. Holders of read-only API keys can cancel running native builds and disrupt CI/CD pipelines. The issue is classified under CWE-862: Missing Authorization.
Critical Impact
Read-only API key holders can repeatedly cancel native builds by opening the SSE log stream and dropping the connection, disrupting build automation and CI/CD workflows.
Affected Products
- Cap-go (capgo) versions prior to 12.128.2
- Self-hosted capgo deployments exposing the build log SSE endpoint
- CI/CD pipelines that depend on capgo native build orchestration
Discovery Timeline
- 2026-06-22 - CVE-2026-56280 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-56280
Vulnerability Analysis
The vulnerability is a server-side authorization gap in the build log streaming path. The capgo backend exposes two distinct endpoints related to native builds. The POST /build/cancel/:jobId endpoint enforces the app.build_native permission before terminating a job. The GET /build/logs/:jobId endpoint, however, only requires read access to stream logs over SSE.
When a client connects to the SSE stream, the server registers an abort listener bound to the underlying request. On client disconnect, the listener invokes cancelBuildOnDisconnect(). That function executes with the privileged BUILDER_API_KEY context rather than the caller's identity. As a result, the cancellation runs without re-evaluating the caller's authorization.
An attacker holding any valid read-only API key can call GET /build/logs/:jobId for any active job. Closing the TCP connection then triggers cancellation under elevated privileges. Repeated invocation creates a denial-of-service condition against build infrastructure.
Root Cause
The root cause is missing authorization on a side-effect path [CWE-862]. The disconnect handler performs a privileged state-changing action without verifying that the caller possesses the app.build_native permission required for explicit cancellation.
Attack Vector
The attack is network-based and requires only a low-privileged API key. An attacker issues GET /build/logs/:jobId against an active native build, waits for the SSE stream to open, and then aborts the connection. The server treats the disconnect as authoritative intent to cancel and terminates the build using the builder's own credentials.
Detection Methods for CVE-2026-56280
Indicators of Compromise
- Frequent short-lived GET /build/logs/:jobId requests followed by abrupt client disconnects.
- Native build jobs transitioning to a cancelled state without a corresponding POST /build/cancel/:jobId request in audit logs.
- Read-only API keys generating cancellation events in build orchestration logs.
Detection Strategies
- Correlate SSE stream disconnects on /build/logs/:jobId with build cancellation events to identify privilege-inverted terminations.
- Alert on cancellation events attributed to the BUILDER_API_KEY that originate from user-initiated log stream sessions.
- Baseline normal log-stream durations and flag sessions terminated within seconds of connection, especially when followed by a build state change.
Monitoring Recommendations
- Forward capgo application logs and reverse proxy access logs to a centralized analytics platform for cross-correlation.
- Track API key usage by permission scope and alert when read-only keys are present in sessions that precede build cancellations.
- Monitor CI/CD pipeline failure rates and unexplained native build cancellations as a leading indicator of abuse.
How to Mitigate CVE-2026-56280
Immediate Actions Required
- Upgrade capgo to version 12.128.2 or later, which removes the unconditional privileged cancellation on SSE disconnect.
- Rotate any API keys that may have been exposed and audit the scope assigned to each key.
- Review build orchestration logs for unexplained cancellations attributed to the builder identity.
Patch Information
The fix is available in capgo 12.128.2. Details are published in the GitHub Security Advisory GHSA-95g7-xwwx-j737 and the VulnCheck Advisory on Privilege Inversion. The patched build removes the disconnect-triggered cancellation path and aligns authorization with the explicit cancel endpoint.
Workarounds
- Restrict network access to the /build/logs/:jobId endpoint to trusted CI/CD runners and operator workstations until the patch is deployed.
- Avoid issuing read-only API keys to untrusted users or third-party integrations on unpatched deployments.
- Place a reverse proxy in front of the capgo backend that rate-limits SSE connections per API key to reduce repeated cancellation attempts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
