CVE-2026-56329: Capgo Cross-Tenant DOS Vulnerability

CVE-2026-56329 Overview

CVE-2026-56329 affects Capgo versions prior to 12.128.2. The vulnerability is a cross-tenant preview namespace collision caused by non-bijective decoding of double underscores to dots during preview hostname parsing. Attackers can register app identifiers containing underscores that collide with legitimate dotted app identifiers belonging to other tenants. The collision causes preview requests to misroute, denying victim tenants access to their own application previews. The flaw is categorized under [CWE-436] Interpretation Conflict and impacts tenant isolation within Capgo's preview subsystem.

Critical Impact
Authenticated attackers can hijack preview routing for other tenants' applications, causing denial of preview access and disrupting multi-tenant workflows.

Affected Products

Capgo versions before 12.128.2
Capgo self-hosted deployments using preview hostname parsing
Multi-tenant Capgo installations exposing preview namespaces

Discovery Timeline

2026-07-10 - CVE-2026-56329 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-56329

Vulnerability Analysis

Capgo hosts application previews under tenant-specific subdomains derived from app identifiers. Because DNS labels cannot contain dots, Capgo encodes dots in app IDs as double underscores when constructing preview hostnames. The decoding path reverses this by converting every __ back into a . before matching the app ID to a tenant. This transformation is non-bijective: an app ID that legitimately contains a double underscore decodes into a string indistinguishable from a different tenant's dotted app ID. An attacker can register an app ID such as victim__app and receive preview traffic intended for victim.app. The collision breaks tenant isolation at the routing layer without requiring exploitation of authentication or authorization controls.

Root Cause

The root cause is an interpretation conflict [CWE-436] between the hostname encoding and decoding functions. The encoder maps . to __ in one direction, but the decoder cannot distinguish encoded dots from originally registered underscores. No canonical form or reserved-character validation exists on app ID registration, allowing attacker-controlled inputs to collide with existing dotted identifiers.

Attack Vector

Exploitation requires a low-privileged authenticated account capable of registering an app ID on the platform. The attacker enumerates or targets a victim tenant's dotted app ID, then registers an app ID replacing each . with __. Preview requests routed through the shared hostname parser now resolve to the attacker's namespace or produce ambiguous routing, denying the victim access to their own previews. Refer to the GitHub Security Advisory and VulnCheck Advisory on Capgo for additional technical context.

No verified public exploit code is available. The vulnerability is described in prose because the flaw is a logical parsing issue rather than a memory or injection defect.

Detection Methods for CVE-2026-56329

Indicators of Compromise

App ID registrations containing sequential double underscore sequences (__) that decode to existing tenant app IDs
Preview traffic logs showing hostname collisions between two distinct tenant namespaces
Tenant support tickets reporting missing or misrouted preview builds
Newly created tenants whose app IDs are structural transformations of established tenants' identifiers

Detection Strategies

Audit the app ID registration table for entries containing __ and cross-reference against existing dotted app IDs after normalization
Instrument the preview hostname decoder to log any decode operation where the resulting string matches more than one registered app ID
Compare registration timestamps between colliding pairs to identify the attacker-registered entry

Monitoring Recommendations

Alert on new app ID registrations that, after __ to . normalization, collide with existing tenants
Monitor preview access logs for HTTP 404 or authorization anomalies clustered on specific tenant hostnames
Track registration velocity from single accounts creating multiple structurally similar app IDs

How to Mitigate CVE-2026-56329

Immediate Actions Required

Upgrade Capgo to version 12.128.2 or later across all environments
Enumerate existing app IDs containing __ and validate that none collide with dotted counterparts belonging to other tenants
Revoke or rename any attacker-registered colliding app IDs identified during the audit

Patch Information

Capgo 12.128.2 resolves the vulnerability by enforcing a canonical, bijective encoding between app IDs and preview hostnames. Review the fix details in the GitHub Security Advisory GHSA-76qq-gg2p-pwwj.

Workarounds

Reject app ID registrations that contain consecutive underscore characters until the patch is applied
Reserve dotted namespaces by pre-registering the underscore-encoded equivalents for existing tenants
Restrict app ID registration to reviewed, allowlisted patterns that exclude ambiguous character sequences

bash

# Configuration example: block ambiguous app IDs at registration
# Reject any app ID containing double underscores prior to upgrading
if [[ "$APP_ID" == *"__"* ]]; then
  echo "Rejected: app ID contains reserved sequence '__'"
  exit 1
fi