What’s Vulnerable › Vulnerabilities

CVE-2026-56306: Capgo - Subkey Enforcement Bypass via x-limited-key-id Header Parsing

• Severity: medium (CVSS 6.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-22 · updated 2026-10-25
• Weakness: CWE-20

Description

Capgo before 12.128.2 contains a weak parsing vulnerability in the x-limited-key-id header that allows attackers to bypass subkey enforcement by submitting malformed values, zero, or duplicate headers that result in NaN or falsy values. Remote attackers can manipulate the x-limited-key-id header to disable limited key scoping and execute requests using the main API key context instead of restricted subkey permissions.

Affected products

• Capgo: before 12.128.2 — fixed in 12.128.2

How to fix

Upgrade to a fixed version: Capgo 12.128.2. Check the vendor advisory for mitigations.

References

• https://github.com/Cap-go/capgo/security/advisories/GHSA-42vv-8j94-24wj
• https://www.vulncheck.com/advisories/capgo-subkey-enforcement-bypass-via-x-limited-key-id-header-parsing
• https://github.com/Cap-go/capgo/security/advisories/GHSA-42vv-8j94-24wj

Get alerted when CVE-2026-56306 or the next vulnerability affects your stack