CVE-2026-56236: Capgo CLI - Arbitrary File Overwrite via Symlink-Following in Local Credential Operations

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-21 · updated 2026-10-25
Weakness: CWE-59

Description

Capgo CLI before 12.128.2 contains arbitrary file overwrite vulnerabilities in login and build credentials operations that follow symlinks without validation. Attackers can create malicious symlinks in repositories to overwrite arbitrary files or expose credentials with world-readable permissions when developers run the CLI.

Affected products

capgo cli: before 12.128.2 — fixed in 12.128.2

How to fix

Upgrade to a fixed version: capgo cli 12.128.2. Check the vendor advisory for mitigations.

References

https://github.com/Cap-go/capgo/security/advisories/GHSA-8mpm-q7mh-8fvh
https://www.vulncheck.com/advisories/capgo-cli-arbitrary-file-overwrite-via-symlink-following-in-local-credential-operations

Get alerted when CVE-2026-56236 or the next vulnerability affects your stack