CVE-2026-56316 Cap-go 12.128.2: Job ID Enumeration & Information Disclosure

Technical summary

The vulnerability exists in the OPTIONS /build/upload/:jobId/* endpoint, which fails to adequately obscure response behavior across valid and invalid job IDs. The information disclosure stems from CWE-203 (Observable Discrepancy), where differential response patterns allow unauthenticated enumeration. An attacker can systematically probe job ID ranges and infer valid identifiers through measurable differences in server responses, then generate sustained traffic for resource exhaustion. No authentication requirement reduces attack friction.

Business impact

This vulnerability enables two distinct attack vectors: (1) disclosure of builder job metadata through reconnaissance, potentially exposing details about internal CI/CD pipelines, build configurations, or scheduled jobs, and (2) resource-based attacks where high-volume unauthenticated requests to the endpoint can degrade service availability. Organizations relying on Cap-go for build infrastructure should assess whether job ID secrecy is a dependency for their security model.

Affected systems

Cap-go versions prior to 12.128.2 are affected. Administrators should verify their deployed version and confirm whether the environment uses the OPTIONS /build/upload/ endpoint. Cloud deployments and self-hosted instances both require remediation.

Exploitability

Exploitability is straightforward because no authentication, user interaction, or special network position is required. The attack surface is the public-facing OPTIONS endpoint itself. An attacker with basic HTTP tooling can enumerate job IDs in an automated fashion. Network accessibility to the Cap-go service is the only prerequisite. The CVSS 5.3 MEDIUM score reflects the direct remote nature of the attack and information disclosure component, offset by the absence of confidentiality impact on data beyond the job ID enumeration itself.

Remediation

Upgrade Cap-go to version 12.128.2 or later. This version addresses the observable discrepancy by standardizing endpoint responses regardless of job ID validity, preventing attackers from distinguishing valid IDs through response analysis. Organizations should also consider network-level rate limiting on the build upload endpoint to mitigate resource consumption attacks.

Patch guidance

Apply the upgrade to Cap-go 12.128.2 as soon as feasible. Verify the upgrade in a non-production environment first to confirm compatibility with your CI/CD workflows. No special configuration changes are required post-upgrade. Coordinate patching with your deployment pipeline to minimize disruption.

Detection guidance

Monitor for patterns of rapid sequential OPTIONS requests to the /build/upload/ endpoint from single sources, especially unauthenticated requests. Unusually high volumes of 404 or error responses from this endpoint may indicate enumeration attempts. Log and alert on anomalous request rates from external IP ranges. Correlate endpoint access logs with your known job ID ranges to identify potential scanning activity.

Why prioritize this

Although the CVSS score is MEDIUM, prioritization should reflect your organization's dependency on build job confidentiality and tolerance for reconnaissance activity. If job IDs or build metadata are considered sensitive or tied to proprietary processes, escalate priority accordingly. Organizations hosting Cap-go in public cloud environments face higher attacker exposure and should patch sooner. The lack of KEV status suggests active exploitation is not yet tracked at scale, but the low barrier to attack warrants prompt remediation.

Risk score, explained

The CVSS 5.3 MEDIUM severity is driven by: (1) Attack Vector Network (remote), (2) Attack Complexity Low (no special setup), (3) Privileges Required None, (4) User Interaction None, and (5) Confidentiality Impact Low (disclosure of job ID enumeration data). Integrity and Availability are not directly impacted by the vulnerability itself, though availability can degrade through sustained unauthenticated traffic abuse. The score does not account for downstream reconnaissance value or organizational sensitivity to build metadata exposure.

Frequently asked questions