CVE-2026-56282: Unauthenticated Information Disclosure in Capgo /replication Endpoint

Technical summary

The vulnerability is an unauthenticated information disclosure in Capgo's /replication endpoint (CWE-200). The endpoint returns PostgreSQL replication telemetry including slot names, confirmed_flush_lsn values, restart_lsn positions, and database error messages. Because the endpoint lacks authentication enforcement, any network-accessible instance of Capgo exposes this data to unauthenticated requests. The CVSS 3.1 score of 5.3 (MEDIUM) reflects low confidentiality impact with no integrity or availability risk: the attacker gains only reconnaissance information without the ability to modify data or cause outages.

Business impact

While the vulnerability itself does not enable data exfiltration or service disruption, it significantly lowers reconnaissance barriers for targeted attacks. Exposed replication topology and LSN positions can inform more sophisticated database attacks—for example, by revealing whether high-availability failover is in place or identifying optimal points for log-based attacks. For organizations with internet-facing Capgo instances, this represents an unnecessary intelligence leak that extends threat actor dwell time during reconnaissance phases.

Affected systems

Capgo versions prior to 12.128.2 are vulnerable. The advisory does not specify which deployment models (cloud, on-premise, containerized) are affected, so assume all installations of vulnerable versions require attention. Verify your Capgo version immediately; if it is below 12.128.2, you are exposed to this endpoint.

Exploitability

Exploitation requires only network access to the Capgo instance and is trivial to perform: no authentication, no complex logic, no user interaction. The attack vector is network-based and the attack complexity is low, making this a low-barrier reconnaissance vector. The endpoint can be discovered via port scanning or service enumeration, and the response format likely makes the returned data self-documenting. However, this vulnerability alone does not provide direct database access or enable compromise; it accelerates reconnaissance for follow-on attacks.

Remediation

Upgrade Capgo to version 12.128.2 or later immediately. If you cannot upgrade immediately, restrict network access to the /replication endpoint via firewall rules or API gateway policies, permitting only trusted internal hosts. Disable the endpoint entirely if it is not required for your deployment. Review firewall and access logs for any prior requests to /replication from external sources.

Patch guidance

Upgrade to Capgo 12.128.2 or later. Consult the Capgo release notes and vendor advisory to verify compatibility and any breaking changes. Test the upgrade in a staging environment before deploying to production. Prioritize this patch for any Capgo instance accessible from untrusted networks.

Detection guidance

Search web server access logs and API gateway logs for requests to the /replication endpoint, particularly from external IP ranges. Monitor for unusual HTTP requests to Capgo endpoints that lack authentication headers. If available, enable verbose logging on the /replication endpoint to capture requestor IP, timestamp, and response size. Correlate suspicious /replication requests with other reconnaissance activity (DNS lookups, port scans) to identify potential coordinated reconnaissance campaigns.

Why prioritize this

Although rated MEDIUM severity, this vulnerability should be prioritized for rapid remediation if your Capgo instance is internet-accessible or exposed to untrusted networks. Reconnaissance information is a proven precursor to targeted attacks; fixing this removes a low-cost intelligence source for attackers. The ease of exploitation and absence of any authentication requirement make this an attractive target for automated scanning tools. Organizations with defense-in-depth already restricting database access may deprioritize this relative to code execution or authentication bypass vulnerabilities, but should still patch within normal patching cycles.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) reflects the nature of the vulnerability: it exposes confidential information (PostgreSQL replication telemetry) without authentication, but does not enable data modification, service disruption, or direct account compromise. The score accurately captures the limited direct impact. However, context matters: if your Capgo instance is internet-facing and your database topology is sensitive, the practical risk may be perceived as higher due to the reconnaissance advantage it grants. If Capgo is isolated to internal networks only, the risk is lower.

Frequently asked questions