CVE-2026-56316: Cap-go Information Disclosure Vulnerability

CVE-2026-56316 Overview

CVE-2026-56316 is an information disclosure vulnerability in Cap-go versions before 12.128.2. The flaw resides in the OPTIONS /build/upload/:jobId/* endpoint, which returns observable response discrepancies for valid versus invalid builder job identifiers. Unauthenticated attackers can probe the endpoint to enumerate valid job IDs and generate sustained traffic that consumes server resources. The issue is classified under CWE-203: Observable Discrepancy.

Critical Impact
Unauthenticated attackers can enumerate valid builder job IDs and drive sustained traffic against the Cap-go API, exposing internal job state and degrading service availability.

Affected Products

Cap-go (capgo) versions prior to 12.128.2
Self-hosted deployments exposing the /build/upload/:jobId/* route
Capacitor-based update delivery pipelines integrating Cap-go builder endpoints

Discovery Timeline

2026-06-21 - CVE-2026-56316 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-56316

Vulnerability Analysis

The vulnerability is an information disclosure oracle exposed through CORS preflight handling. The OPTIONS /build/upload/:jobId/* endpoint processes requests without enforcing authentication on the supplied jobId. Server responses differ in observable ways depending on whether the job identifier corresponds to an existing record. An attacker iterating over candidate jobId values can distinguish valid from invalid identifiers based on these discrepancies.

Because the endpoint accepts unauthenticated requests, the same probing also functions as a resource consumption vector. Attackers can generate sustained traffic against the builder upload path without credentials, increasing backend load on job lookup operations. The vulnerability affects confidentiality of internal job metadata but does not directly compromise integrity or availability of stored data.

Root Cause

The root cause is missing authentication on the preflight OPTIONS handler combined with response behavior that varies based on resource existence. The handler reveals existence state through differences such as status codes, headers, or response timing before any authorization check occurs.

Attack Vector

Exploitation requires only network access to the Cap-go API. An attacker issues OPTIONS requests to /build/upload/:jobId/* with guessed or brute-forced jobId values and compares responses to identify valid identifiers. The attack requires no privileges, no user interaction, and no prior authentication.

No verified proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-9c2x-7h5x-37gm and the VulnCheck Advisory for technical details.

Detection Methods for CVE-2026-56316

Indicators of Compromise

High-volume OPTIONS requests to /build/upload/:jobId/* originating from a single source or distributed set of IPs
Sequential or dictionary-style iteration over jobId path parameters in access logs
Unauthenticated requests to builder endpoints producing mixed success and failure response codes in short windows

Detection Strategies

Baseline normal OPTIONS request volume per source IP against the /build/upload/ path and alert on deviations
Correlate unauthenticated requests with response code variance to identify enumeration patterns
Inspect web access logs for repeated probing of jobId values that do not correspond to authenticated upload sessions

Monitoring Recommendations

Log all preflight OPTIONS requests with source IP, path, and response status for the builder API
Apply rate limiting metrics and alert thresholds at the API gateway or reverse proxy
Forward web server and application logs to a centralized analytics platform for retention and pattern analysis

How to Mitigate CVE-2026-56316

Immediate Actions Required

Upgrade Cap-go (capgo) to version 12.128.2 or later
Restrict unauthenticated access to the /build/upload/:jobId/* route at the application or reverse proxy layer
Apply rate limiting to the builder upload endpoints to slow enumeration attempts

Patch Information

The fix is included in Cap-go 12.128.2. Review the GitHub Security Advisory GHSA-9c2x-7h5x-37gm for the upstream patch details and upgrade guidance.

Workarounds

Enforce authentication on the OPTIONS handler before any database lookup occurs, returning uniform responses for valid and invalid jobId values
Deploy a Web Application Firewall (WAF) rule blocking unauthenticated OPTIONS requests to /build/upload/:jobId/*
Normalize response status codes, headers, and timing for the endpoint so that valid and invalid identifiers are indistinguishable

bash

# Example NGINX rate limit and auth requirement for the builder endpoint
limit_req_zone $binary_remote_addr zone=capgo_options:10m rate=10r/m;

location ~ ^/build/upload/[^/]+/ {
    limit_req zone=capgo_options burst=5 nodelay;
    if ($request_method = OPTIONS) {
        return 401;
    }
    proxy_pass http://capgo_backend;
}