CVE-2026-56316 Details
Description
Cap-go before 12.128.2 contains an information disclosure vulnerability in the OPTIONS /build/upload/:jobId/* endpoint that allows unauthenticated attackers to enumerate valid builder job IDs through observable response discrepancies. Attackers can probe the endpoint without authentication to distinguish valid job IDs from invalid ones and generate sustained unauthenticated traffic for resource consumption.
A information disclosure vulnerability has been identified in Cap-go versions prior to 12.128.2. The issue resides in the OPTIONS /build/upload/:jobId/* endpoint, which is accessible without authentication. This vulnerability allows unauthenticated attackers to enumerate valid builder job IDs by exploiting observable discrepancies in the responses. Attackers can send requests to this endpoint to differentiate between valid and invalid job IDs, while also generating sustained unauthenticated traffic that consumes resources.
To address this vulnerability, it is recommended to require authentication for the OPTIONS /build/upload/:jobId/* endpoint. Alternatively, the OPTIONS requests can be handled locally without proxying to the TUS upload functionality, returning static TUS capability headers instead. Implementing IP-based rate limiting for the /build/upload/* route can also help mitigate potential abuse.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 21, 2026CISA-ADP
Assessed Jun 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Cap-go/capgo/security/advisories/GHSA-9c2x-7h5x-37gm | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Cap-go/capgo/security/advisories/GHSA-9c2x-7h5x-37gm | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/cap-go-job-existence-oracle-via-unauthenticated-options-build-upload-jobid | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-203 | Observable Discrepancy | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Cap-go | < 12.128.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 24, 2026 | CVE Modified | CISA-ADP |
| Jun 21, 2026 | New CVE Received | [email protected] |