CVE-2026-56281: Capgo SQL Injection Vulnerability

CVE-2026-56281 Overview

CVE-2026-56281 is a SQL injection vulnerability in Capgo versions before 12.128.2. The flaw exists in the POST /private/admin_stats endpoint. The limit parameter is destructured from the unvalidated request body and interpolated directly into Cloudflare Analytics Engine SQL queries via template literals. An attacker with platform admin credentials can inject SQL fragments to enumerate dataset schemas, extract analytics data, or trigger denial-of-service against the analytics backend. The weakness is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated platform admins can inject arbitrary SQL fragments into Cloudflare Analytics Engine queries to exfiltrate analytics data or disrupt the analytics backend.

Affected Products

Capgo (Cap-go/capgo) versions prior to 12.128.2
Affected endpoint: POST /private/admin_stats
Backend impacted: Cloudflare Analytics Engine SQL interface

Discovery Timeline

2026-07-12 - CVE-2026-56281 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-56281

Vulnerability Analysis

The vulnerability originates in the administrative statistics endpoint of Capgo, an open-source platform for over-the-air updates for Capacitor applications. The POST /private/admin_stats handler destructures a limit value from the incoming JSON request body without validating its type, length, or numeric range. That value is then embedded directly into a SQL query string using JavaScript template literals before the query is dispatched to the Cloudflare Analytics Engine.

Because template literal interpolation performs no escaping or parameterization, an attacker can supply a limit value containing SQL syntax rather than an integer. The resulting query executes attacker-controlled SQL fragments against the analytics dataset. Consequences include schema enumeration, extraction of analytics records, and resource exhaustion against the analytics backend, producing denial-of-service conditions.

Exploitation requires high privileges: the caller must already hold platform admin credentials. This constraint reduces the population of viable attackers but does not eliminate the risk, particularly in scenarios involving credential compromise, insider threat, or lateral movement from another admin-facing weakness.

Root Cause

The root cause is direct string interpolation of untrusted input into a SQL statement, classified as CWE-89. The code path assumes limit is a safe numeric value, but no runtime validation enforces that assumption before the query is constructed and executed.

Attack Vector

The attack vector is network-based. An authenticated admin sends a crafted JSON payload to POST /private/admin_stats with a malicious limit value containing SQL syntax. The server interpolates the value into the Analytics Engine query and executes it, returning attacker-influenced results or degraded service. No user interaction beyond issuing the HTTP request is required.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-6ffx-8hjj-jhhf and the VulnCheck advisory for additional technical detail.

Detection Methods for CVE-2026-56281

Indicators of Compromise

Requests to POST /private/admin_stats where the JSON limit field is a string rather than an integer, or contains SQL keywords such as UNION, SELECT, --, or ;.
Unusually large or malformed response payloads returned from the admin stats endpoint.
Analytics Engine query errors or elevated query latency correlated with admin_stats traffic.

Detection Strategies

Inspect HTTP application logs for POST /private/admin_stats requests and validate that the limit parameter parses as a bounded integer.
Deploy Web Application Firewall (WAF) rules that block non-numeric limit values or payloads containing SQL metacharacters on admin endpoints.
Correlate admin authentication events with subsequent admin_stats calls to identify anomalous session behavior or credential misuse.

Monitoring Recommendations

Alert on any admin_stats request producing Analytics Engine query errors or response codes indicating backend failure.
Track baseline query volume and payload size to admin_stats and flag statistically significant deviations.
Monitor platform admin account activity for unusual source IPs, off-hours access, or bursts of API calls to privileged endpoints.

How to Mitigate CVE-2026-56281

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later, which contains the fix for this vulnerability.
Audit platform admin accounts, rotate credentials, and enforce multi-factor authentication for all administrative access.
Review recent access logs for POST /private/admin_stats calls and investigate any requests with non-integer limit values.

Patch Information

The upstream fix is published in the Capgo project. Refer to the GitHub Security Advisory GHSA-6ffx-8hjj-jhhf for patch commits and release notes covering version 12.128.2. Deploy the patched release across all Capgo instances, including staging and disaster-recovery environments.

Workarounds

If immediate patching is not possible, restrict access to /private/admin_stats at the reverse proxy or WAF layer using IP allowlisting.
Add a validation layer that rejects requests to admin_stats when limit is not a positive integer within a defined maximum bound.
Temporarily disable the admin stats endpoint if it is not required for operational use until the patched version is deployed.

bash

# Example NGINX-level guard for the admin_stats endpoint
location = /private/admin_stats {
    allow 10.0.0.0/8;      # Restrict to internal admin network
    deny all;
    proxy_pass http://capgo_backend;
}