CVE-2026-56334 Details
Description
Capgo before 12.128.2 lacks an UPDATE row-level security policy for the build_requests table, preventing API-key and anonymous access from persisting builder status updates. Attackers can exploit this missing policy to cause build status and error details to remain unpersisted, leaving build_requests rows stuck in pending state with null last_error values.
A vulnerability exists in Capgo versions prior to 12.128.2, where the application lacks an UPDATE row-level security policy for the build_requests table. This absence prevents API-key and anonymous users from successfully updating builder status, leaving build_requests entries in a pending state with no error information. Attackers can exploit this flaw to disrupt the normal functioning of build status updates, causing incorrect or stale data to be presented to users and API consumers.
Users can update the row-level security policy to allow UPDATE operations on the build_requests table for anonymous and authenticated users. This can be done by scoping the policy to the appropriate organizational and application identifiers, ensuring that users with the right permissions can successfully update build request statuses.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 30, 2026CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Cap-go/capgo/security/advisories/GHSA-gc46-h5j6-qp6q | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Cap-go/capgo/security/advisories/GHSA-gc46-h5j6-qp6q | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/capgo-missing-update-rls-policy-for-build-status-persistence | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Capgo | < 12.128.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 1, 2026 | CVE Modified | CISA-ADP |
| Jun 30, 2026 | New CVE Received | [email protected] |