CVE-2026-56282: Capgo Information Disclosure Vulnerability

CVE-2026-56282 Overview

Capgo before version 12.128.2 contains an information disclosure vulnerability in the unauthenticated /replication endpoint. The endpoint exposes internal PostgreSQL replication telemetry without requiring authentication. Attackers can retrieve replication slot names, confirmed_flush_lsn values, restart_lsn positions, and Write-Ahead Log (WAL) Log Sequence Number (LSN) data. The endpoint also leaks database error messages useful for reconnaissance. The flaw is tracked under Common Weakness Enumeration [CWE-200] for exposure of sensitive information to an unauthorized actor.

Critical Impact
Unauthenticated remote attackers can enumerate internal PostgreSQL replication infrastructure details, enabling targeted follow-on attacks against the database backend.

Affected Products

Capgo versions prior to 12.128.2

Discovery Timeline

2026-06-20 - CVE-2026-56282 published to the National Vulnerability Database (NVD)
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-56282

Vulnerability Analysis

The vulnerability resides in Capgo's /replication HTTP endpoint. The endpoint serves PostgreSQL replication state data to any caller, with no authentication or authorization check. Returned data includes replication slot identifiers, WAL LSN markers such as confirmed_flush_lsn and restart_lsn, and verbatim database error strings.

This telemetry is designed for internal observability and operational tooling. Exposing it to unauthenticated network clients reveals the structure and state of the backend PostgreSQL deployment. Attackers gain reconnaissance value such as slot naming conventions, replication progress, and clues about database schema or version through error message content.

The Exploit Prediction Scoring System (EPSS) currently rates the probability of exploitation at a low percentile, but reconnaissance flaws often precede targeted intrusions.

Root Cause

The root cause is missing access control on a diagnostic endpoint [CWE-200]. The /replication route was implemented without an authentication middleware or network-layer restriction. Sensitive PostgreSQL internals were returned directly in the HTTP response body. Verbose error propagation amplifies the disclosure by surfacing raw database errors to the caller.

Attack Vector

An attacker issues an unauthenticated HTTP GET request to the /replication path of an exposed Capgo instance. The server responds with JSON or text containing replication slot metadata and WAL LSN positions. No credentials, tokens, or user interaction are required. The attacker uses the disclosed slot names and LSN values to map replication topology, then pivots to credential-stuffing, schema enumeration, or exploitation of the underlying PostgreSQL instance.

The vulnerability is exploitable across the network, making any internet-reachable Capgo deployment before 12.128.2 susceptible.

Detection Methods for CVE-2026-56282

Indicators of Compromise

Unauthenticated HTTP GET requests to the /replication path in Capgo access logs
Requests from unfamiliar IP addresses or scanning infrastructure querying replication telemetry endpoints
HTTP 200 responses on /replication containing strings such as confirmed_flush_lsn, restart_lsn, or replication slot identifiers

Detection Strategies

Review web server and reverse proxy logs for any request matching the /replication URI without a valid session or API token
Correlate /replication access patterns with subsequent reconnaissance behavior such as PostgreSQL port scans or schema enumeration attempts
Deploy web application firewall (WAF) rules that alert on responses containing PostgreSQL replication keywords leaving the application

Monitoring Recommendations

Enable verbose HTTP access logging on Capgo deployments and forward logs to a centralized analytics platform
Monitor for elevated request volume against diagnostic or observability endpoints from external sources
Track Capgo version inventory and alert when instances running versions earlier than 12.128.2 are detected

How to Mitigate CVE-2026-56282

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later as published in the GitHub Security Advisory
Restrict network access to Capgo administrative and diagnostic endpoints using firewall rules or reverse proxy allowlists
Audit historical access logs for prior unauthenticated requests to /replication

Patch Information

The vendor released a fix in Capgo version 12.128.2. Details are published in the GitHub Security Advisory GHSA-q6gm-xfwr-44f5 and the VulnCheck Advisory on Capgo. Apply the upgrade across all production and staging environments.

Workarounds

Block external access to the /replication path at the reverse proxy or load balancer layer until the patch is applied
Place Capgo behind an authenticating gateway that requires valid credentials for all diagnostic endpoints
Suppress verbose PostgreSQL error messages in upstream responses to reduce reconnaissance value

bash

# Example NGINX configuration to deny external access to /replication
location = /replication {
    allow 10.0.0.0/8;
    deny all;
    return 403;
}