CVE-2026-56280: Cap-go Privilege Inversion in Build Log Streaming (CVSS 7.1)

Technical summary

The vulnerability exists in the GET /build/logs/:jobId endpoint, which streams Server-Sent Events (SSE) to clients viewing build logs. When a client disconnects, the endpoint's abort listener automatically invokes cancelBuildOnDisconnect() using the server's BUILDER_API_KEY credential, completely bypassing the app.build_native permission check that the explicit POST /build/cancel/:jobId endpoint enforces. This represents a privilege inversion: the read-only permission level of the attacker's API key is never validated before the cancellation operation executes with privileged server credentials. CWE-862 (Missing Authorization) classifies this as a failure to verify that the client has the required privilege before performing a sensitive action.

Business impact

Developers and CI/CD systems relying on Cap-go's native build service face operational disruption. An insider with read-only API access, or an attacker who has compromised such credentials, can repeatedly sabotage build pipelines by canceling jobs in progress. This creates unpredictable delays, failed deployments, and erosion of pipeline reliability. The low barrier to exploitation (simply opening and closing a connection) and the lack of special privileges required beyond read-only API access make this particularly dangerous in organizations where read-only credentials are broadly distributed or poorly managed.

Affected systems

Cap-go versions prior to 12.128.2 are affected. The vulnerability is present in the SSE-based build log streaming endpoint and impacts any deployment or automation relying on Cap-go's native build capabilities. Organizations using Cap-go for iOS and Android build automation should identify and audit all systems running vulnerable versions.

Exploitability

This vulnerability is straightforward to exploit: an attacker needs only a read-only API key and network access to the Cap-go instance. No special setup, no race conditions, and no user interaction is required. The attack is repeatable and leaves minimal forensic traces beyond the canceled build event itself. The simplicity of the attack vector and the prevalence of read-only API key distribution in many organizations elevates practical exploitability significantly.

Remediation

Upgrade Cap-go to version 12.128.2 or later immediately. The patch corrects the privilege inversion by ensuring that the cancelBuildOnDisconnect() function is only invoked when the initiating client has been verified to hold the app.build_native permission. Additionally, audit all read-only API keys in use and rotate any that may have been exposed or distributed to untrusted parties. Consider restricting API key distribution and implementing per-action API key scoping if the platform supports it.

Patch guidance

Cap-go 12.128.2 contains the fix for this vulnerability. Verify the specific version deployed in your environment and apply the upgrade during a maintenance window. Given the high severity and simple exploitability, this should be prioritized for immediate patching. Test the build log streaming and cancellation functionality after upgrading to ensure no regressions. If running Cap-go in a CI/CD environment, coordinate the upgrade with your build pipeline scheduling to avoid disruption.

Detection guidance

Monitor for unusual patterns of build cancellations, particularly those initiated by API keys with read-only permissions or those corresponding to log streaming sessions. Check application logs for repeated GET /build/logs/:jobId requests followed immediately by disconnections and subsequent cancel events. Implement alerting on cancel operations that do not correspond to explicit POST /build/cancel/:jobId requests. Review audit logs for API key usage and flag any read-only keys performing privileged actions. Network-based detection should look for frequent connection drops to the log streaming endpoint from the same source.

Why prioritize this

This vulnerability merits immediate attention due to the combination of high CVSS score (7.1), high severity, simple exploitability requiring only a read-only API key, and significant business impact on CI/CD reliability. The straightforward nature of the attack means it could be exploited by threat actors, malicious insiders, or competitors seeking to disrupt your build operations. No active exploitation is currently tracked in known exploit databases, but the low technical barrier ensures that weaponization is trivial.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) reflects: attack vector network (AV:N), low attack complexity (AC:L), low privilege requirement (PR:L using read-only key), no user interaction (UI:N), and unchanged scope (S:U). The impact includes no confidentiality loss (C:N), low integrity impact (I:L—the build state is modified), and high availability impact (A:H—jobs are canceled and workflows disrupted). The score appropriately captures that an authenticated but low-privileged user can cause significant service disruption without requiring additional complexity or user interaction.

Frequently asked questions