CVE-2026-56244: Capgo Webhook Signature Forgery via Leaked Secrets

Technical summary

CVE-2026-56244 results from insufficient row-level security (RLS) policies on Capgo's webhooks table in Supabase REST. Non-admin API keys can execute SELECT queries against webhook records and retrieve the webhook_secret field, which should be accessible only to webhook owners or administrators. The signature scheme depends on keeping this secret confidential; once compromised, an attacker can compute valid X-Capgo-Signature HMAC values for any webhook payload and send them to configured receiver endpoints. The vulnerability affects the confidentiality and integrity of the webhook authentication mechanism.

Business impact

Webhook forgery could allow attackers to inject false events into downstream systems that rely on Capgo webhooks for critical business logic—such as license verification, deployment triggers, or billing events. If your organization uses Capgo webhooks to coordinate deployments, payments, or user provisioning, compromised signatures could lead to unauthorized state changes. The attack does not require user interaction and can be performed at scale by any entity with an API key, including disgruntled users or competitors with legitimate access.

Affected systems

Capgo versions before 12.128.2 are affected. The vulnerability requires an attacker to possess a valid non-admin API key; organizations using Capgo should verify their current version and assess who holds API keys with webhook visibility. Self-hosted or air-gapped Capgo deployments may have different exposure profiles depending on their Supabase configuration.

Exploitability

Exploitability is moderate to high. The vulnerability requires network access and possession of a non-admin API key (authentication is required), but no additional user interaction or complex conditions are needed. Once a valid API key is obtained—whether through employee misuse, credential leakage, or social engineering—the attack is straightforward: query the webhooks table and extract the signing secret. No client-side logic or browser exploitation is required. The attack surface is broad for any organization that distributes API keys to developers or integrators.

Remediation

Upgrade Capgo to version 12.128.2 or later. This release is expected to include corrected RLS policies that prevent non-admin API keys from reading webhook secrets. After upgrading, consider rotating all webhook signing secrets as a precautionary measure, since you cannot be certain whether keys were exposed prior to the patch. Review API key distribution policies to minimize the number of non-admin keys in circulation and implement audit logging on API key usage.

Patch guidance

Verify the patch version against the official Capgo changelog and advisory. Apply version 12.128.2 or later to all Capgo instances. The patch should restrict webhook_secret visibility to administrative users or the key's owner. Test webhook signature validation after upgrading to confirm the RLS policy changes do not break legitimate webhook flows. If running Capgo with Supabase, confirm that your Supabase configuration supports the patched RLS rules and is not overriding them with overly permissive defaults.

Detection guidance

Monitor Capgo API logs for unexpected SELECT queries against the webhooks table from non-admin API keys. Check for API keys querying the schema or reading webhook configuration data. Review webhook receiver logs for anomalous webhook events with valid signatures but unexpected or suspicious payloads (timestamps, user IDs, or actions that do not match your event stream). If Supabase audit logs are available, search for RLS policy violations or for SELECT queries on webhook_secret columns. Correlate API key usage with employee or service account identities to identify compromised keys.

Why prioritize this

This vulnerability merits rapid patching because it directly undermines the authenticity guarantees of a critical security mechanism (webhook signatures). Unlike many informational disclosures, compromised webhook secrets create an active, ongoing risk: an attacker with a stolen secret can forge events indefinitely without additional interaction. Organizations that rely on Capgo webhooks for compliance, billing, or deployment coordination should prioritize this fix highly. The CVSS score of 7.1 (HIGH) reflects the confidentiality breach and the ability to forge authenticated messages, making this a significant integrity threat.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) is justified by the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. The vulnerability requires authentication (PR:L) but offers high confidentiality impact (C:H) by exposing secrets that enable integrity violations (I:L). Network-accessible endpoints and low attack complexity (AC:L) with no user interaction required (UI:N) push the score into the HIGH range. The unchanged availability (A:N) prevents it from reaching CRITICAL, but the combination of secret exposure and signature forgery capability is serious.

Frequently asked questions