Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
CVE-2026-56280: Cap-go allows read-only keys to stop builds
CVE-2026-56280 · published 4 months ago
Summary
Cap-go versions before 12.128.2 let anyone with a read‑only API key open a build log stream and then disconnect to cancel an ongoing native build. This bypasses the normal permission check, causing build jobs to be interrupted and CI/CD pipelines to fail. Update to version 12.128.2 or later, or restrict access to the log endpoint, to stop the issue.
Original advisory text
Cap-go - Privilege Inversion in Build Log Stream via SSE Disconnect
Cap-go before 12.128.2 contains a privilege inversion vulnerability in GET /build/logs/:jobId that allows read-only API key holders to cancel running native builds. The endpoint registers an abort listener on the SSE stream that unconditionally invokes cancelBuildOnDisconnect() using the privileged server-side BUILDER_API_KEY when clients disconnect, bypassing the app.build_native permission check required by the explicit POST /build/cancel/:jobId endpoint. Attackers with read-only API keys can repeatedly disrupt native build operations and CI/CD workflows by opening the log stream and dropping the connection.
References
- https://github.com/Cap-go/capgo/security/advisories/GHSA-95g7-xwwx-j737 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56280... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-56280 Vendor Advisory
- https://www.vulncheck.com/advisories/cap-go-privilege-inversion-in-build-log-str... Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-862Missing Authorization
Timeline
Published22 Jun 2026
Updated4 Nov 2026
First seen22 Jun 2026
Track software like this
Free during beta