What’s Vulnerable › Vulnerabilities

CVE-2026-56328: Capgo - Integrity Issue in Release Routing via Multiple Public Channels

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-30 · updated 2026-07-01
• Weakness: CWE-670

Description

Capgo before 12.128.2 allows multiple public channels for the same app and platform to coexist simultaneously, while unnamed /updates requests without defaultChannel implicitly resolve to a single hidden winner channel. An authorized app or channel manager can create ambiguous default update state and silently influence which bundle unnamed clients receive, breaking release routing integrity and predictability.

Affected products

• Capgo: before 12.128.2 — fixed in 12.128.2

How to fix

Upgrade to a fixed version: Capgo 12.128.2. Check the vendor advisory for mitigations.

References

• https://github.com/Cap-go/capgo/security/advisories/GHSA-3cmp-pm5x-8464
• https://www.vulncheck.com/advisories/capgo-integrity-issue-in-release-routing-via-multiple-public-channels
• https://github.com/Cap-go/capgo/security/advisories/GHSA-3cmp-pm5x-8464

Get alerted when CVE-2026-56328 or the next vulnerability affects your stack