CVE-2026-56307: Cap-go Broken Cursor Pagination Vulnerability

Technical summary

CVE-2026-56307 is a cursor pagination vulnerability affecting Cap-go's /private/devices endpoint on the Cloudflare/workerd runtime. The flaw stems from non-advancing cursor filters that fail to progress through result sets correctly. Authenticated attackers holding app.read_devices permissions can trigger infinite pagination loops by exploiting this broken cursor state. The vulnerability prevents full dataset traversal, leaving portions of the device inventory inaccessible beyond the looping segment. This maps to CWE-670 (Improper Input Validation) and carries a CVSS 3.1 score of 4.3 (MEDIUM severity).

Business impact

Device-management integrations relying on Cap-go's API to enumerate or audit device fleets will encounter operational friction. Automated workflows that walk through device lists—such as inventory synchronization, compliance audits, or bulk operations—may stall or repeat work on the same subset of devices, consuming resources and delaying business processes. Organizations using Cap-go for multi-tenant device orchestration should expect degraded visibility and potential data inconsistencies if pagination loops prevent complete enumeration.

Affected systems

Cap-go versions prior to 12.128.12 are affected. The vulnerability is specific to the /private/devices endpoint when deployed on Cloudflare/workerd infrastructure. Only authenticated users with app.read_devices permission can trigger the issue, limiting exposure to users with explicit device-read roles.

Exploitability

The vulnerability requires valid authentication credentials and the app.read_devices permission—it is not exploitable by unauthenticated users. Exploitation is straightforward once those preconditions are met: a user simply requests the devices endpoint and encounters pagination that loops rather than advances. No specialized tooling or unusual interaction patterns are required; standard API pagination logic will trigger the flaw. The barrier to exploitation is low for privileged insiders but absent for external attackers without credentials.

Remediation

Upgrade Cap-go to version 12.128.12 or later. This version includes a corrected cursor implementation that properly advances through result sets and eliminates infinite pagination loops. Organizations should test the upgrade in a non-production environment first to confirm that existing device-management automation resumes normal operation.

Patch guidance

Deploy Cap-go 12.128.12 or any subsequent release. Verify the upgrade in a staging environment by confirming that pagination through large device lists completes without looping and that all devices in the inventory are reachable. If you are on a version between the affected range and 12.128.12, verify against the vendor advisory to confirm the exact minimum version required for your deployment.

Detection guidance

Monitor API logs for repeated pagination tokens or cursor values in successive /private/devices requests from the same authenticated session. If a cursor does not advance between requests, or if the same device records appear across multiple paginated responses, the broken pagination is likely active. Additionally, track device-management job logs for workflows that do not complete or that process the same device subset repeatedly, which may indicate an encounter with this vulnerability.

Why prioritize this

While the CVSS score is MEDIUM (4.3), this is primarily a denial-of-service and workflow disruption issue rather than a confidentiality or integrity threat. Prioritization should reflect operational impact: if device management is mission-critical or if compliance audits depend on complete device enumeration, treat this as higher priority. If device-management workflows are less frequent or redundant, this can be scheduled in a normal maintenance window. The vulnerability is not in the CISA KEV catalog, further supporting a standard (not emergency) remediation timeline.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects low attack complexity, requirement for valid authentication, and network-based access, but no confidentiality or integrity impact. The only impact vector is availability—pagination loops disrupt workflow completion and dataset traversal. The MEDIUM severity is appropriate because the flaw does not expose secrets, corrupt data, or grant unauthorized access; it merely obstructs the ability to retrieve complete result sets.

Frequently asked questions