CVE-2026-56243: Capgo API Key Hashing Bypass in PostgREST/RLS

Technical summary

The vulnerability exists in Capgo's API authentication layer, specifically in how the PostgREST/RLS plane handles the capgkey header. When enforce_hashed_api_keys is enabled at the organizational level—a setting designed to require all API keys to be hashed before use—the system incorrectly accepts plaintext (unhashed) API keys. This represents a failure in security control validation: the enforcement mechanism does not block plaintext keys as intended, allowing an authenticated user to circumvent the hashed-key requirement and directly access the RLS-protected backend. The flaw maps to CWE-288 (Authentication Bypass Using an Alternate Path or Channel).

Business impact

Organizations relying on Capgo's hashed-key enforcement to prevent unauthorized access face a direct loss of that control layer. An insider or compromised account holder can bypass org-level security policy and gain unauthorized access to protected data and functionality. The impact extends beyond single-user compromise to organizational policy bypass—meaning even if primary API key security is strong, this vulnerability allows authenticated users to work around additional controls meant to enforce stronger authentication standards. Data confidentiality and integrity are at risk.

Affected systems

Capgo versions prior to 12.128.2 are affected. The vulnerability resides in the PostgREST/RLS plane authentication handling. Systems where enforce_hashed_api_keys is enabled are at direct risk of bypass. Verify your Capgo version and check whether this setting is active in your organizational configuration.

Exploitability

The vulnerability requires an authenticated user (PR:L in the CVSS vector) and is exploitable over the network with no special conditions or user interaction needed. An attacker already inside the system—via a compromised account, insider threat, or legitimate user with malicious intent—can trivially exploit this by crafting requests with plaintext API keys in the capgkey header. The bar for exploitation is low once authentication is present, making this a significant risk in multi-tenant or high-trust environments.

Remediation

Upgrade Capgo to version 12.128.2 or later. This patch closes the plaintext-key acceptance hole and ensures that enforce_hashed_api_keys operates as designed. Verify the patch is applied and that the setting remains enabled post-upgrade. Until patching is complete, consider additional monitoring of API authentication patterns and review access logs for suspicious plaintext key usage.

Patch guidance

Apply Capgo version 12.128.2 or any subsequent release. Consult the Capgo vendor advisory for specific upgrade procedures and any configuration validation steps. After patching, confirm that enforce_hashed_api_keys is still enabled and monitor for any authentication-related errors during the transition. Consider a staged rollout if Capgo is critical to your production environment.

Detection guidance

Look for authentication requests containing the capgkey header with plaintext (non-hashed) values in your API access logs, particularly after the vulnerability disclosure. Compare observed API key formats against your hashing scheme baseline; plaintext keys where hashed keys are expected indicate potential exploitation. Monitor for authentication attempts from unexpected or dormant accounts using plaintext keys. Review PostgREST/RLS logs for bypass patterns or direct access attempts that circumvent your org-level key policies.

Why prioritize this

This vulnerability scores HIGH (CVSS 8.1) due to the combination of high confidentiality and integrity impact, low attack complexity, and network accessibility. The fact that it bypasses an intentional security control—rather than just allowing stronger access—elevates its strategic importance. Organizations with strong role-based or policy-enforced API key management are specifically targeted by this flaw. Prioritize patching in environments where enforce_hashed_api_keys is active and where sensitive or regulated data is protected by Capgo.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects: (1) Network-based attack vector—no physical access required; (2) Low complexity—no special conditions or race conditions needed; (3) Low privilege requirement—an authenticated user with basic system access can trigger the flaw; (4) No user interaction necessary; (5) Impact limited to the affected system (not a network-wide cascade); (6) High confidentiality impact (unauthorized data access); (7) High integrity impact (potential unauthorized modification); (8) No availability impact. The authentication requirement (PR:L) prevents a perfect 10, but the ease of exploitation and control-bypass nature justify the HIGH severity rating.

Frequently asked questions