CVE-2026-56324: Capgo Rate Limit Bypass Allows Remote DoS Attack

Technical summary

The vulnerability exists in the channel_self endpoint of Capgo, which uses a user-controlled device_id parameter to track requests. The rate-limiting mechanism fails to properly normalize or validate this parameter, enabling attackers to bypass per-device limits by rotating device_id values. Each unique device_id is treated as a separate request stream, allowing an attacker to make hundreds or thousands of requests per second by cycling through different identifiers. The resulting database writes to the channel_devices table accumulate rapidly, exhausting storage, compute, and query performance.

Business impact

This vulnerability poses a direct threat to service availability. An attacker with no authentication can degrade or disable Capgo's functionality by flooding the database with malicious entries. This impacts all downstream customers and applications relying on Capgo's update and deployment services. Depending on deployment scale, the attack requires minimal resources to execute but can force emergency remediation, incident response costs, and potential SLA breaches.

Affected systems

Capgo prior to version 12.128.2 is affected. The vulnerability is specific to the channel_self endpoint and the channel_devices table. Organizations running Capgo in production—especially those exposing the channel_self endpoint to untrusted networks—are at risk. No authentication is required to exploit this issue.

Exploitability

Exploitability is high. The attack requires no authentication, no user interaction, and minimal technical sophistication. An attacker only needs network access to the endpoint and the ability to vary the device_id parameter across requests. The barrier to exploitation is extremely low; a simple script can automate device_id rotation and send high-velocity requests. The attack is also difficult to distinguish from legitimate traffic without enhanced rate-limiting or behavioral analysis.

Remediation

Upgrade Capgo to version 12.128.2 or later. The patched version implements proper rate-limiting logic that is not bypassable through device_id rotation. Organizations should verify the upgrade was successful by testing the endpoint under load and confirming that rate limits are now enforced consistently across unique device identifiers.

Patch guidance

Apply Capgo version 12.128.2 or later as soon as possible. This is a high-severity availability issue that can be weaponized remotely. Prioritize patching in all environments—development, staging, and production. Review your deployment process to ensure patches are applied promptly. If you cannot patch immediately, consider restricting network access to the channel_self endpoint or implementing additional rate-limiting controls at the reverse proxy or WAF level.

Detection guidance

Monitor for abnormal spike in requests to the channel_self endpoint, particularly from a single source IP with rapidly varying device_id values. Alert on sustained high request rates (hundreds or thousands per second) that exceed normal baseline traffic. Log and review entries in the channel_devices table for signs of mass insertion (rapid growth in row count, bulk writes from single IPs). Analyze device_id diversity: legitimate traffic typically has a small set of repeating device identifiers, while an attack exhibits near-random or numerically sequential patterns. Consider implementing adaptive rate-limiting that tracks aggregate requests per source IP regardless of device_id.

Why prioritize this

This vulnerability warrants immediate attention due to its high CVSS score (8.2), zero authentication requirement, low exploitation complexity, and direct impact on availability. The attack surface is network-accessible and exploitable by any unauthenticated attacker. The simplicity of the exploit—rotating a parameter—means threat actors can weaponize this quickly. Patch immediately to prevent denial-of-service incidents.

Risk score, explained

The CVSS 3.1 score of 8.2 (HIGH) reflects the following factors: Network-accessible attack vector (AV:N), low attack complexity (AC:L), no privilege or user interaction required (PR:N, UI:N), and high availability impact (A:H). While confidentiality is not affected (C:N), the integrity impact (I:L) stems from database pollution. The score appropriately captures the real-world risk: an unauthenticated remote attacker can cause service degradation or outage with minimal effort.

Frequently asked questions