CVE-2026-56232: Capgo API Key Bypass Vulnerability – Authentication Bypass in Subkey Validation

Technical summary

The vulnerability exists in Capgo's middlewareKey function, which processes the x-limited-key-id header to identify which API key should be used for a request. The function fails to properly validate that the referenced subkey actually belongs to the requesting user and that its assigned constraints (limited_to_orgs and limited_to_apps) are enforced. When a subkey reference is invalid or tampered with, the middleware falls back to using the parent key without restriction, creating a privilege escalation path. This affects all downstream route handlers that depend on proper key scoping. The issue is present in versions prior to 12.128.2.

Business impact

Organizations using Capgo for CI/CD deployments face significant operational risk. An insider or compromised low-privilege API key could escalate to full account control, enabling unauthorized application deployments, data exfiltration, or sabotage across multiple projects or organizations. This undermines the security model of delegated, scoped API access—a foundational practice for multi-team deployments. Customers relying on API key segmentation for access control must assume that boundary has been breached until patched.

Affected systems

Capgo versions prior to 12.128.2 are affected. The vulnerability requires an authenticated user (PR:L) and impacts the API key validation mechanism used across all HTTP routes that depend on proper subkey enforcement. Any deployment or integration relying on scoped API keys is at risk.

Exploitability

Exploitation requires an authenticated account with at least one API key or subkey (low privilege requirement). The attacker does not need user interaction (UI:N) and can exploit this over the network (AV:N) with minimal complexity (AC:L). Proof of exploitation involves crafting a request with a manipulated x-limited-key-id header referencing an attacker-controlled subkey, then observing that the request is processed with parent key permissions. The attack is straightforward once the vulnerability is understood.

Remediation

Upgrade to Capgo version 12.128.2 or later immediately. This patch version enforces validation of limited_to_orgs and limited_to_apps constraints on subkeys, preventing the privilege escalation. Organizations should also audit their API key usage logs between the vulnerability's public disclosure (June 24, 2026) and patch deployment to identify any suspicious subkey references or elevated access patterns.

Patch guidance

Apply the 12.128.2 release as soon as possible—this is a high-severity vulnerability in a privileged code path. Verify the patch by reviewing the release notes and confirming the middlewareKey function now properly validates subkey ownership and constraints before honoring the x-limited-key-id header. After patching, confirm that scoped API keys are once again properly restricted in your testing environment before deploying to production.

Detection guidance

Monitor authentication logs and API audit trails for x-limited-key-id headers that reference subkeys, especially in patterns where a subkey reference is followed by operations outside its declared scope (limited_to_orgs or limited_to_apps). Look for requests where subkey IDs don't match the requesting user's actual subkey inventory. If possible, instrument the middlewareKey function to log when a fallback to parent key occurs due to validation failure. Compare API activity before and after the vulnerability window to identify anomalous access patterns.

Why prioritize this

This vulnerability scores CVSS 8.8 (HIGH) due to the combination of network accessibility, low privilege barrier, and high impact across confidentiality, integrity, and availability. The bug is in a critical authentication enforcement point, making it a foundational security failure rather than a niche edge case. Although it is not yet in the CISA KEV catalog, the simplicity of exploitation and the sensitivity of API key management warrant immediate patching. Any organization using Capgo should treat this as urgent.

Risk score, explained

The CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H score reflects: (1) Network-accessible attack vector with low complexity; (2) Low privilege requirement (any authenticated user); (3) No user interaction needed; (4) Unrestricted scope within the user's authorization boundary; (5) High impact on confidentiality (unauthorized access to restricted orgs/apps), integrity (ability to modify or deploy to restricted environments), and availability (potential for disruptive deployments). The HIGH severity is appropriate for a privilege escalation flaw in API key validation.

Frequently asked questions