CVE-2026-56280

High

Description

Cap-go before 12.128.2 contains a privilege inversion vulnerability in GET /build/logs/:jobId that allows read-only API key holders to cancel running native builds. The endpoint registers an abort listener on the SSE stream that unconditionally invokes cancelBuildOnDisconnect() using the privileged server-side BUILDER_API_KEY when clients disconnect, bypassing the app.build_native permission check required by the explicit POST /build/cancel/:jobId endpoint. Attackers with read-only API keys can repeatedly disrupt native build operations and CI/CD workflows by opening the log stream and dropping the connection.

SeverityHigh

CVSS7.1

Exploit probability—

ProductCap-go Capgo

PublishedJun 22, 2026

First seenJun 22, 2026

Weakness typeCWE-862Missing authorization

How to fix

Update

Cap-go capgo12.128.2 or later

Vendor advisories

github.com/Cap-go/capgo/security/advisories/GHSA-95g7-xwwx-j737

Affected products

Product	Affected versions	Fixed in
Cap-go capgo	v < 12.128.2	12.128.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.