CVE-2026-56248: Capgo - Unauthenticated Denial-of-Service via audit_logs RLS Policy

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-23 · updated 2026-10-25
Weakness: CWE-400

Description

Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial-of-service vulnerability arising from the audit_logs table's Row-Level Security (RLS) policy when accessed via the Supabase PostgREST API. Because the PostgreSQL query planner executes costly logic before RLS rejection, unfiltered queries to the public.audit_logs endpoint using the public anon key consistently trigger statement timeouts (PostgREST error 57014). Under concurrency, this exhausts database resources and causes cascading HTTP 500 failures on unrelated endpoints (e.g. /orgs), resulting in an application-layer denial of service.

Affected products

Cap-go capgo: before 12.128.12 — fixed in 12.128.12

How to fix

Upgrade to a fixed version: Cap-go capgo 12.128.12. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-56248 or the next vulnerability affects your stack