CVE-2026-56329: Capgo Cross-Tenant Preview Namespace Collision Vulnerability

Technical summary

CVE-2026-56329 stems from non-bijective decoding logic in Capgo's preview hostname parser. When preview URLs are constructed, double underscores (__) are intended to be converted to dots (.), but the decoding process is not one-to-one: both 'app__id' and 'app.id' can decode to the same internal identifier. An authenticated attacker can exploit this by registering a malicious app ID containing underscores that hashes to the same namespace as a legitimate tenant's dotted app ID. This causes the preview system to misdirect requests and deny service to the victim application's preview functionality. The vulnerability is classified under CWE-436 (Untrusted Input in Format String).

Business impact

For Capgo users, this vulnerability undermines the reliability of preview environments—a critical part of the development workflow. Attackers can hijack or block preview access for competing or targeted applications, forcing teams to either downgrade Capgo or work around broken preview functionality. For multi-tenant SaaS operators using Capgo, the cross-tenant nature of the collision creates a secondary risk: a rogue actor might isolate another organization's development team from their preview tools, causing operational friction and potential delays to release cycles.

Affected systems

Capgo versions prior to 12.128.2 are affected. The vulnerability requires the attacker to be an authenticated user of the Capgo platform (PR:L in the CVSS vector), so it is not exploitable by anonymous actors. Any organization running an affected version of Capgo in a multi-tenant or shared preview namespace environment is at risk.

Exploitability

Exploitation requires an active Capgo account (low privilege) and knowledge of a victim's app ID structure. No complex techniques or special conditions are needed—an attacker can register a crafted app ID and trigger preview traffic misdirection. The attack surface is network-accessible and straightforward to execute, though the scope is limited to users of the affected software. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog as of the publication date.

Remediation

Organizations using Capgo must upgrade to version 12.128.2 or later. This patch version implements bijective decoding for namespace identifiers, ensuring that no two app IDs—whether using underscores or dots—can collide during preview URL parsing. Verify the specific patch version number and upgrade instructions by consulting the official Capgo release notes.

Patch guidance

Upgrade Capgo to version 12.128.2 or later. This is a straightforward patch release and should be prioritized for any deployment handling multi-tenant or shared preview namespaces. Test the upgrade in a staging environment to confirm preview functionality is restored and no app ID collisions occur. If you are unable to upgrade immediately, isolate preview systems and restrict who can register new app IDs until patching is complete.

Detection guidance

Monitor Capgo logs for unusual preview namespace access patterns, particularly requests that appear to cross between different app IDs or tenants. Look for app IDs registered with underscores that closely resemble existing dotted app IDs in your environment. If possible, audit recent app registrations for anomalous naming that might indicate collision attempts. Check preview traffic routing to see if any legitimate preview requests are being misdirected or denied.

Why prioritize this

Although this vulnerability has a CVSS score of 6.4 (MEDIUM), it should be prioritized based on its cross-tenant impact and the criticality of preview functionality to development workflows. It is not currently on CISA's KEV list, but the ease of exploitation (network-accessible, low-privilege attack) and the direct operational impact on preview access warrant prompt patching. Organizations with heavy reliance on Capgo's preview features or those operating in competitive or sensitive environments should patch sooner rather than later.

Risk score, explained

The CVSS 3.1 score of 6.4 reflects a network-accessible, low-privilege attack with low complexity. The vulnerability causes both integrity impact (misdirected traffic) and availability impact (preview denial), but does not expose confidential data. The score correctly weights the cross-tenant scope (S:C) as a severity multiplier. However, the real-world risk is amplified by the fact that preview environments are integral to development and that an attacker only needs a valid account—making this a notable risk for any Capgo user.

Frequently asked questions