CVE-2026-56299: Capgo Authentication Bypass and Denial of Service Vulnerability

Technical summary

CVE-2026-56299 is an authentication bypass vulnerability in Capgo's /build/upload/:jobId/* endpoint. The flaw stems from improper handling of HTTP OPTIONS requests, which can bypass authentication middleware before reaching the tusProxy logic. When invalid credentials are passed through this bypass, the service consistently returns HTTP 500 errors. Attackers can exploit this to flood the endpoint with requests, exhausting server resources and causing availability impact. The vulnerability is classified under CWE-306 (Missing Authentication Check).

Business impact

Service availability is the primary concern. Continuous denial-of-service attacks can prevent legitimate teams from uploading builds, disrupting CI/CD pipelines and delaying releases. Unlike vulnerabilities that expose data or grant unauthorized access, this flaw's impact is operational disruption rather than data breach risk. However, persistent unavailability can cascade through development workflows and damage team productivity.

Affected systems

Capgo versions prior to 12.128.2 are affected. The CVSS vector indicates network accessibility without special conditions—any internet-connected Capgo deployment running a vulnerable version is at risk. Organizations using Capgo for build distribution should verify their installed version immediately.

Exploitability

Exploitability is straightforward. The attack requires only network access and no authentication; an attacker simply sends HTTP OPTIONS requests to the vulnerable endpoint with invalid credentials. No special tools, user interaction, or insider knowledge is required. The simplicity of triggering 500 errors makes this suitable for basic automated scanning and request-flooding attacks, though the barrier to weaponization is low.

Remediation

Upgrade Capgo to version 12.128.2 or later. This patch addresses the authentication middleware bypass and corrects the handling of OPTIONS requests on the affected endpoint. Organizations should treat this as a priority upgrade given the ease of exploitation and availability impact, even though the CVSS score is moderate.

Patch guidance

Verify your current Capgo version and plan an upgrade to 12.128.2 or later. Review the Capgo release notes for that version to confirm the authentication bypass fix is included and check for any breaking changes or dependency updates. Test the upgrade in a staging environment before rolling out to production, particularly if you have custom build pipelines or proxied upload workflows.

Detection guidance

Monitor your Capgo access logs for unusual spikes in OPTIONS requests to /build/upload/ endpoints, especially from unexpected source IPs. Alert on sustained sequences of HTTP 500 errors from that endpoint. If your Capgo instance is exposed to the internet, consider temporarily restricting access to that endpoint via firewall or WAF rules to trusted IP ranges pending patch deployment. Log analysis should focus on authentication failures followed by proxy invocation attempts.

Why prioritize this

Although the CVSS score is moderate (5.3), the ease of exploitation and lack of authentication requirements make this a practical threat. Any publicly accessible Capgo instance is trivially vulnerable to abuse. Prioritize patching based on exposure: internet-facing deployments should be updated urgently, while internal-only instances can follow standard maintenance windows. The availability impact justifies treating this as higher priority than the numeric score suggests.

Risk score, explained

The CVSS:3.1 score of 5.3 (MEDIUM) reflects low attack complexity, no privilege requirement, and network accessibility balanced against limited impact scope (availability only, no confidentiality or integrity loss). The score appropriately captures a DoS vulnerability; however, real-world risk depends on whether your Capgo instance is internet-facing and how critical your build pipeline uptime is to business operations.

Frequently asked questions