CVE-2026-56324: Capgo Rate Limit Bypass Vulnerability

CVE-2026-56324 Overview

CVE-2026-56324 is a rate limit bypass vulnerability in Capgo, an open-source live update server for Capacitor applications, affecting versions before 12.128.2. The flaw resides in the channel_self endpoint, which enforces rate limiting based on a user-controlled device_id parameter. Attackers rotate the device_id value across requests to bypass throttling and flood the channel_devices database table. The resulting write volume causes database resource exhaustion and degrades service availability for legitimate tenants. The vulnerability is categorized under CWE-770: Allocation of Resources Without Limits or Throttling.

Critical Impact
Unauthenticated attackers can exhaust the Capgo backend database by rotating device_id values, producing a denial-of-service condition for all hosted update channels.

Affected Products

Capgo (Cap-go/capgo) versions prior to 12.128.2
Self-hosted Capgo update server deployments
Capacitor applications relying on a vulnerable Capgo backend for live updates

Discovery Timeline

2026-06-22 - CVE-2026-56324 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-56324

Vulnerability Analysis

The channel_self endpoint in Capgo accepts a device_id parameter supplied by the client. The server enforces rate limiting per device_id rather than per source IP address, authenticated tenant, or another server-controlled identifier. Because the client controls the rate-limit key, an attacker can submit each request with a freshly generated device_id and entirely evade the throttle.

Each request that passes the rate-limit check writes a row into the channel_devices table. By cycling device_id values at high frequency from a single host, an attacker can insert thousands of rows per second. The resulting growth in table size and write contention consumes connection pool capacity, disk I/O, and storage, leading to database exhaustion and service degradation for all consumers of the affected Capgo instance.

Root Cause

The root cause is improper selection of the rate-limit identifier. Trusting a user-controlled parameter as the throttling key violates the principle that rate-limit state must be keyed on a value the client cannot freely manipulate. This is a classic instance of CWE-770, where resource allocation proceeds without an effective upper bound.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker scripts repeated HTTP requests to the channel_self endpoint, supplying a unique device_id value, such as a random UUID, on each call. See the GitHub Security Advisory GHSA-77p2-9rcr-5w27 and the VulnCheck advisory for additional technical context.

Detection Methods for CVE-2026-56324

Indicators of Compromise

High volume of requests to the channel_self endpoint originating from a small number of source IP addresses
Rapid growth in row count of the channel_devices table without a corresponding increase in active application installs
Unique device_id values that do not match expected UUID patterns or that never recur across sessions
Elevated database CPU, connection pool saturation, or write latency on the Capgo backend

Detection Strategies

Correlate request rates to channel_self against the count of distinct source IPs and authenticated tenants to surface one-to-many device_id rotation patterns
Baseline normal channel_devices insert rates and alert on deviations exceeding the historical 99th percentile
Inspect HTTP access logs for entries to channel_self where the device_id parameter changes on every request from the same client fingerprint

Monitoring Recommendations

Forward Capgo application and database telemetry to a centralized logging or SIEM platform for correlation with network metadata
Track per-source-IP request rates to /channel_self and alert on bursts that exceed expected device provisioning volumes
Monitor PostgreSQL metrics for sudden increases in inserts on channel_devices, lock contention, and connection saturation

How to Mitigate CVE-2026-56324

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later on all self-hosted instances
Place the Capgo backend behind a reverse proxy or web application firewall that enforces per-IP rate limiting on the channel_self endpoint
Audit the channel_devices table for anomalous growth and remove orphaned rows created during any suspected abuse window

Patch Information

The maintainers fixed the issue in Capgo version 12.128.2. Review the GitHub Security Advisory GHSA-77p2-9rcr-5w27 for patch details and upgrade guidance. Operators of self-hosted deployments should redeploy the updated container or package and verify the running version.

Workarounds

Enforce rate limiting at the edge using source IP address as the key, independent of any client-supplied identifier
Require authentication on the channel_self endpoint and key rate limits to the authenticated principal
Add database-level constraints or quotas that cap channel_devices inserts per tenant within a rolling time window

bash

# Example nginx per-IP rate limit for the channel_self endpoint
# Refer to vendor documentation before applying in production
limit_req_zone $binary_remote_addr zone=channel_self:10m rate=5r/s;

location /channel_self {
    limit_req zone=channel_self burst=10 nodelay;
    proxy_pass http://capgo_backend;
}