What’s Vulnerable › Vulnerabilities

CVE-2026-56316: Cap-go - Job Existence Oracle via Unauthenticated OPTIONS /build/upload/:jobId/*

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-21 · updated 2026-10-25
• Weakness: CWE-203

Description

Cap-go before 12.128.2 contains an information disclosure vulnerability in the OPTIONS /build/upload/:jobId/* endpoint that allows unauthenticated attackers to enumerate valid builder job IDs through observable response discrepancies. Attackers can probe the endpoint without authentication to distinguish valid job IDs from invalid ones and generate sustained unauthenticated traffic for resource consumption.

Affected products

• Cap-go capgo: before 12.128.2 — fixed in 12.128.2

How to fix

Upgrade to a fixed version: Cap-go capgo 12.128.2. Check the vendor advisory for mitigations.

References

• https://github.com/Cap-go/capgo/security/advisories/GHSA-9c2x-7h5x-37gm
• https://www.vulncheck.com/advisories/cap-go-job-existence-oracle-via-unauthenticated-options-build-upload-jobid
• https://github.com/Cap-go/capgo/security/advisories/GHSA-9c2x-7h5x-37gm

Get alerted when CVE-2026-56316 or the next vulnerability affects your stack