CVE-2026-56334 Overview
CVE-2026-56334 affects Capgo versions before 12.128.2. The application lacks an UPDATE row-level security (RLS) policy on the build_requests table. This missing policy prevents API-key and anonymous access from persisting builder status updates. Attackers can exploit this gap to leave build status and error details unpersisted. Affected build_requests rows remain stuck in a pending state with null last_error values. The weakness maps to [CWE-284: Improper Access Control].
Critical Impact
Missing UPDATE RLS policy on the build_requests table blocks legitimate builder status persistence, leaving rows in a pending state with null error details and disrupting build request workflows.
Affected Products
- Capgo versions prior to 12.128.2
- Capgo build_requests PostgreSQL table access layer
- Deployments relying on API-key or anonymous access to update build status
Discovery Timeline
- 2026-06-30 - CVE-2026-56334 published to the National Vulnerability Database (NVD)
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-56334
Vulnerability Analysis
Capgo uses PostgreSQL row-level security policies to gate access to the build_requests table. The pre-12.128.2 schema defines policies for SELECT and INSERT operations but omits an UPDATE policy applicable to API-key and anonymous principals. When a builder attempts to write back status transitions or populate the last_error column, the database silently rejects the write under the default-deny RLS behavior. The row remains in its initial pending state with a null last_error field.
The result is a persistent state corruption of the build queue rather than data disclosure or code execution. Automation depending on build_requests state transitions cannot progress, and diagnostic error details are lost.
Root Cause
The root cause is a missing UPDATE RLS policy for the roles used by Capgo's builder pipeline. PostgreSQL RLS enforces a default-deny stance on any operation without a matching policy. Because the schema authors added SELECT and INSERT policies but not the corresponding UPDATE policy, all update statements from API-key and anonymous contexts fail silently. The application does not surface the failure to callers.
Attack Vector
The issue is network-reachable and requires low-privileged access, such as a valid API key. An attacker or misconfigured client with API-key access can trigger builds and observe that status updates never persist. This creates conditions for denial of legitimate build progress reporting and impairs incident triage by hiding last_error values. Exploitation does not require user interaction. Refer to the GitHub Security Advisory and the VulnCheck Advisory on Capgo for authoritative technical details.
Detection Methods for CVE-2026-56334
Indicators of Compromise
- Rows in the build_requests table that remain in pending status well beyond expected build durations.
- Persistent null values in the last_error column even after builders report failures out-of-band.
- Divergence between builder-side logs showing completed or failed builds and database state showing no progression.
Detection Strategies
- Audit PostgreSQL RLS policies on build_requests and confirm that an UPDATE policy exists for every role that must write status transitions.
- Enable log_statement = 'mod' on the database to capture UPDATE attempts and correlate them against unchanged row versions.
- Compare application-emitted build outcome events against database row state to detect silent write suppression.
Monitoring Recommendations
- Alert on build_requests rows whose status remains pending past a defined SLA threshold.
- Track API-key sessions that issue UPDATE statements against build_requests and measure their effective row-change counts.
- Monitor Capgo release channels and the GitHub Security Advisory for follow-on fixes or related RLS issues.
How to Mitigate CVE-2026-56334
Immediate Actions Required
- Upgrade Capgo to version 12.128.2 or later, which introduces the missing UPDATE RLS policy for build_requests.
- Inventory all API keys and anonymous roles that interact with the build_requests table and validate their expected privileges.
- Reprocess or manually resolve stuck pending rows to restore accurate build state.
Patch Information
Capgo 12.128.2 adds the required UPDATE row-level security policy so that builder status transitions and last_error values persist correctly. Deployments should apply the upstream release from the Capgo repository. See the GitHub Security Advisory GHSA-gc46-h5j6-qp6q for the vendor's fix guidance.
Workarounds
- Manually add an UPDATE RLS policy on build_requests that permits the builder roles to modify status and last_error while patching is scheduled.
- Restrict issuance of API keys with access to build orchestration until the upgrade is applied.
- Implement out-of-band logging of builder status and error messages so operators retain visibility even when database writes are suppressed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
