CVE-2026-56299: Capgo Authentication Bypass Vulnerability

CVE-2026-56299 Overview

CVE-2026-56299 is an authentication bypass vulnerability in Capgo versions prior to 12.128.2. The flaw resides in the /build/upload/:jobId/* endpoint, where the authentication middleware fails to validate OPTIONS requests before passing them to the tusProxy logic. Unauthenticated remote attackers can send crafted OPTIONS requests with invalid credentials, triggering consistent HTTP 500 errors. The condition enables trivial request flooding and results in a denial of service against the Capgo service. The weakness is classified under [CWE-306: Missing Authentication for Critical Function].

Critical Impact
Unauthenticated attackers can flood the /build/upload/:jobId/* endpoint with OPTIONS requests to exhaust resources and disrupt Capgo build upload availability.

Affected Products

Capgo versions prior to 12.128.2
Self-hosted Capgo deployments exposing the /build/upload/:jobId/* endpoint
Capgo build upload service routing through tusProxy

Discovery Timeline

2026-06-21 - CVE-2026-56299 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-56299

Vulnerability Analysis

The vulnerability stems from incomplete authentication enforcement on the /build/upload/:jobId/* route. The Capgo backend implements authentication middleware intended to validate credentials before forwarding requests to the tusProxy handler. However, the middleware does not correctly intercept HTTP OPTIONS preflight requests, allowing them to reach downstream logic without valid authentication context.

When the tusProxy handler receives an OPTIONS request bearing invalid or absent credentials, it attempts to process the request and fails, returning a consistent HTTP 500 status. Each request consumes backend processing cycles, and the absence of authentication checks removes any natural rate limit tied to valid accounts. An attacker can issue high volumes of these requests from any network position to exhaust server resources.

Root Cause

The root cause is missing authentication enforcement for non-GET/POST HTTP methods on a route reachable by unauthenticated clients. The middleware does not treat OPTIONS as a method requiring authentication, while the proxied logic still attempts credential-bound operations. This mismatch between middleware coverage and handler expectations produces an exception path that an attacker can invoke repeatedly.

Attack Vector

Exploitation is remote and requires no authentication, no user interaction, and low attack complexity. The attacker sends OPTIONS requests to /build/upload/:jobId/* against any reachable Capgo instance. Because each request reliably produces a server-side error without rate-limited authentication, the attacker can script flooding to degrade or disable the service.

No verified exploitation code is published for CVE-2026-56299. Technical details are described in the GitHub Security Advisory GHSA-6c7m-4223-446j and the VulnCheck Denial of Service Advisory.

Detection Methods for CVE-2026-56299

Indicators of Compromise

High volumes of HTTP OPTIONS requests targeting /build/upload/:jobId/* from single or distributed source addresses.
Spikes in HTTP 500 responses from the Capgo backend tied to the tusProxy code path.
Requests to the upload endpoint with missing, malformed, or invalid authentication headers.

Detection Strategies

Inspect web server and reverse proxy logs for repeated OPTIONS /build/upload/ entries paired with 5xx response codes.
Correlate application error logs referencing tusProxy with the source IP and request method to surface flood patterns.
Build alerting on anomalous request-rate baselines for the build upload endpoint, segmented by authentication outcome.

Monitoring Recommendations

Track per-IP request rates and 500 error rates for /build/upload/:jobId/* and alert on sustained deviations.
Forward Capgo access and error logs to a centralized log platform for retention and pattern analysis.
Monitor backend CPU, memory, and worker queue saturation to detect resource exhaustion linked to request floods.

How to Mitigate CVE-2026-56299

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later, which corrects the authentication middleware behavior.
Apply rate limiting at the reverse proxy or web application firewall in front of /build/upload/:jobId/*.
Block or restrict unauthenticated OPTIONS requests to the upload endpoint until patching is complete.

Patch Information

The maintainers fixed the issue in Capgo 12.128.2. The patch ensures the authentication middleware evaluates OPTIONS requests on the /build/upload/:jobId/* route before invoking tusProxy, preventing unauthenticated invocation of the proxy logic. See the GitHub Security Advisory GHSA-6c7m-4223-446j for the maintainer's remediation notes.

Workarounds

Deploy a WAF rule that drops OPTIONS requests to /build/upload/:jobId/* from clients lacking a valid session token.
Enforce strict per-IP rate limits on the upload endpoint at the edge proxy layer.
Restrict network reachability of the Capgo build upload service to trusted CI/CD egress ranges where feasible.

bash

# Example NGINX rate limit and OPTIONS restriction for the affected endpoint
limit_req_zone $binary_remote_addr zone=capgo_upload:10m rate=5r/s;

location ~ ^/build/upload/[^/]+/.* {
    limit_req zone=capgo_upload burst=10 nodelay;

    if ($request_method = OPTIONS) {
        return 204;
    }

    proxy_pass http://capgo_backend;
}