CVE-2026-56243: Capgo - Hashed API Key Enforcement Bypass via PostgREST/RLS Plane

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-23 · updated 2026-10-25
Weakness: CWE-288

Description

Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plaintext API keys through the capgkey header despite enforce_hashed_api_keys being enabled. Attackers can bypass org-level hashed-key enforcement by sending plaintext API keys directly to the PostgREST/RLS plane to access protected resources.

Affected products

Capgo: before 12.128.2 — fixed in 12.128.2

How to fix

Upgrade to a fixed version: Capgo 12.128.2. Check the vendor advisory for mitigations.

References

https://github.com/Cap-go/capgo/security/advisories/GHSA-6g74-8cpq-g2c8
https://www.vulncheck.com/advisories/capgo-hashed-api-key-enforcement-bypass-via-postgrest-rls-plane
https://github.com/Cap-go/capgo/security/advisories/GHSA-6g74-8cpq-g2c8

Get alerted when CVE-2026-56243 or the next vulnerability affects your stack