CVE-2026-56296: Cap-go Information Disclosure Vulnerability

CVE-2026-56296 Overview

CVE-2026-56296 is an information disclosure vulnerability in Cap-go versions prior to 12.128.2. The flaw resides in the public.transfer_app Remote Procedure Call (RPC) function, which returns distinct error messages for existing versus non-existing application identifiers. Unauthenticated attackers can enumerate valid app IDs by observing the differing error responses when calling transfer_app with only the publishable API key. The issue is classified under CWE-203: Observable Discrepancy.

Critical Impact
Unauthenticated attackers can enumerate valid Cap-go application identifiers over the network without any privileges or user interaction, enabling reconnaissance for follow-on attacks against discovered applications.

Affected Products

Cap-go (capgo) versions before 12.128.2
Deployments exposing the public.transfer_app RPC endpoint
Instances accessible with only the publishable API key

Discovery Timeline

2026-07-11 - CVE-2026-56296 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-56296

Vulnerability Analysis

The vulnerability is an observable discrepancy in the error-handling logic of the public.transfer_app RPC function exposed by Cap-go. When a client invokes transfer_app with an application identifier, the backend returns a different error string depending on whether that app ID exists in the database. This behavioral difference converts a transfer function into an existence oracle for application identifiers.

The endpoint accepts requests authenticated with only the publishable API key, which is designed to be broadly distributed to client-side code. As a result, an attacker without any privileged credentials can iterate through candidate app IDs and record which ones produce the "exists" error branch versus the "does not exist" branch. Enumerated identifiers can then be used to target subsequent attacks against specific applications, correlate app IDs with public disclosures, or build reconnaissance datasets.

Root Cause

The root cause is failure to normalize error responses across code paths that handle valid and invalid input. The transfer_app RPC discloses server-side state through observable differences in its error messages rather than returning a uniform response for any authorization or lookup failure.

Attack Vector

Exploitation is network-based, requires no authentication beyond the publishable API key, and involves no user interaction. An attacker scripts repeated calls to transfer_app while varying the app ID parameter and classifies responses based on the returned error text or code. Because the publishable key is not a secret, the attack surface is effectively public.

No verified exploit code has been published. See the GitHub Security Advisory GHSA-fmm3-3qcg-85j6 and the VulnCheck Advisory for the technical write-up.

Detection Methods for CVE-2026-56296

Indicators of Compromise

High-volume requests to the public.transfer_app RPC endpoint from a single source or narrow set of IP addresses.
Sequential or dictionary-style iteration of the app ID parameter within short time windows.
Requests authenticated only with a publishable API key and no session or bearer token context.

Detection Strategies

Baseline normal call rates to transfer_app per API key and alert on statistical deviations.
Alert when the ratio of "app not found" to "app exists" errors from one client exceeds an expected threshold.
Correlate publishable-key traffic patterns against known scraping user agents and hosting provider IP ranges.

Monitoring Recommendations

Log every transfer_app invocation with app ID, source IP, API key identifier, and response classification.
Ship RPC logs to a centralized analytics platform for retention and long-horizon anomaly review.
Track unique app IDs queried per API key per hour and flag keys that probe large ID spaces.

How to Mitigate CVE-2026-56296

Immediate Actions Required

Upgrade Cap-go to version 12.128.2 or later where the discrepancy is resolved.
Audit access logs for public.transfer_app to identify prior enumeration attempts.
Rotate publishable API keys that show anomalous transfer_app activity.

Patch Information

The vendor addressed the issue in Cap-go 12.128.2. Details are published in the GitHub Security Advisory GHSA-fmm3-3qcg-85j6. Upgrading to the fixed version normalizes error responses so that existing and non-existing app IDs produce indistinguishable output.

Workarounds

Apply rate limiting to the transfer_app RPC endpoint per source IP and per publishable API key.
Restrict transfer_app invocation to authenticated sessions rather than publishable-key-only access where feasible.
Deploy a Web Application Firewall (WAF) rule to block high-volume, iterative requests against the RPC path until the upgrade is deployed.

bash

# Configuration example: rate limit transfer_app RPC at the reverse proxy
# nginx example - limit each client to 10 requests per minute
limit_req_zone $binary_remote_addr zone=capgo_rpc:10m rate=10r/m;

location /rest/v1/rpc/transfer_app {
    limit_req zone=capgo_rpc burst=5 nodelay;
    proxy_pass http://capgo_backend;
}