CVE-2026-56334: Capgo Missing Row-Level Security on Build Requests Update

Technical summary

CVE-2026-56334 stems from an absent UPDATE row-level security (RLS) policy on the build_requests table in Capgo's database layer. The vulnerability permits authenticated API-key and anonymous access patterns to execute UPDATE statements that do not persist, resulting in build_requests rows remaining in pending state with null last_error columns. This occurs because the RLS policy that should govern data modification for these access contexts is entirely missing, violating the principle of least privilege and proper access control enforcement.

Business impact

Build systems dependent on Capgo will experience degraded observability and operational reliability. Build jobs will appear to be in progress indefinitely, preventing teams from detecting failures or taking corrective action. This can disrupt CI/CD pipelines, delay releases, and create false confidence in build status. Teams relying on error details to troubleshoot build failures will find those diagnostic records absent, increasing mean time to resolution for infrastructure issues.

Affected systems

Capgo deployments running versions prior to 12.128.2 are affected. The vulnerability is triggered when build status updates originate from API-key or anonymous authentication contexts. Organizations using Capgo for build orchestration and relying on accurate build status reporting are at risk.

Exploitability

Exploitation requires network access and either a valid API key or the ability to make anonymous requests to the Capgo service. No user interaction or special conditions are needed once access is established. An attacker or misconfigured system can repeatedly trigger failed status updates, causing build_requests to accumulate in a stuck pending state. The low attack complexity and lack of privilege escalation requirements make this straightforward to exploit, though the impact is primarily on data integrity rather than confidentiality or system availability.

Remediation

Upgrade Capgo to version 12.128.2 or later, which includes the missing UPDATE row-level security policy for the build_requests table. Organizations should prioritize this patch for all Capgo deployments that process build requests via API key or anonymous access. Verify against the vendor advisory that your installed version receives the RLS policy fix.

Patch guidance

Apply Capgo version 12.128.2 or any subsequent release. Before patching, document current build_requests state to identify any stuck jobs that may require manual intervention post-upgrade. Test the patch in a non-production environment to confirm that build status updates now persist correctly and error details are captured. After deployment, monitor build job logs to ensure the RLS policy is functioning as intended and status updates are being written to the database.

Detection guidance

Review Capgo build_requests table for rows in pending state with null or missing last_error values, particularly those that have been pending longer than expected build execution times. Monitor API logs for UPDATE statements on build_requests that complete without corresponding database record changes. Query the Capgo audit trail (if available) to identify which authentication contexts (API key, anonymous) are issuing status update requests. Set alerts on builds that remain pending beyond a reasonable threshold.

Why prioritize this

Although rated MEDIUM severity, this vulnerability directly impacts operational visibility and data integrity in build pipelines. The absence of an RLS policy is a configuration-level security control failure rather than a code vulnerability, making it both easy to verify and urgent to fix. Teams managing build systems should treat this as a priority because stuck builds can cascade into downstream deployment and release delays. The fix is contained and low-risk, supporting rapid deployment.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects limited scope—the impact is confined to the build_requests table with no cross-boundary effects. Integrity impact is rated as low because the vulnerability affects only the persistence of status updates, not the confidentiality of data or availability of the service itself. Attack vector is network-based and requires authentication (PR:L), reducing the risk profile. However, the real-world operational impact of stuck builds argues for treating this with higher-than-CVSS priority within build-critical environments.

Frequently asked questions