CVE-2026-56280 Details

A privilege inversion vulnerability has been identified in Cap-go versions prior to 12.128.2. The issue resides in the GET /build/logs/:jobId endpoint, where read-only API key holders can cancel running native builds. This vulnerability arises because the endpoint, while protected by a read-only permission, automatically registers an abort listener on the Server-Sent Events (SSE) stream. When a client disconnects, the server invokes a build cancellation function using a privileged server-side API key, bypassing the necessary permission check. As a result, attackers with read-only API keys can disrupt native build processes and continuous integration/continuous deployment (CI/CD) workflows by simply opening the log stream and then dropping the connection.

The recommended fix is to remove the automatic cancellation on SSE disconnect for read-only users or to add a permission check before registering the abort listener. This ensures that only users with the appropriate privileges can cancel builds via the log stream.