Capacitor Updater CVE-2026-56254

Exploitation requires the attacker to obtain the client-distributed private signing key (trivially recoverable because it ships inside every downloaded app) AND to occupy one of two positions on the update path: an active man-in-the-middle on the network channel between the device and the Capgo update server, or compromise/control of the Capgo server itself. The affected feature is specifically the end-to-end encrypted/signed update mechanism of @capgo/capacitor-updater versions before 12.128.2 - apps not using capgo's OTA update signing are not exposed. Limiting factors: the MITM-or-server-control prerequisite (reflected as AC:H) means this is not exploitable purely remotely against an untouched device; transport protections such as TLS certificate pinning further raise the bar for the MITM variant. No target-device authentication or user interaction is required once the position is achieved (PR:N/UI:N).

This is a genuine integrity/software-supply-chain risk rather than a mere high-CVSS paper cut, but exploitation is gated. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N) shows network reach with no privileges or user interaction, yet AC:H reflects that the attacker must first achieve a meaningful position - an active man-in-the-middle on the update channel or compromise of the Capgo server. Impact is skewed toward integrity (VI:H) with only limited confidentiality and availability (VC:L/VA:L), consistent with the core outcome being malicious-code installation rather than data theft or outage. No EPSS score, KEV entry, POC, or SSVC decision data was supplied, so probabilistic and active-exploitation signals are absent; the practical risk is that private-key distribution is a permanent, latent weakness in every deployed vulnerable version until the app is rebuilt with the fixed plugin. Net: prioritize for any app shipping this plugin, but the AC:H prerequisite means opportunistic mass exploitation is less likely than targeted attacks against the update path.

An attacker extracts the embedded private key from a shipped app (or intercepts it) and, from a man-in-the-middle position on a shared/hostile network, serves a forged update bundle that carries a valid signature derived from the leaked keypair. The victim device accepts the bundle as authentic and installs attacker-controlled code; alternatively, an attacker who compromises the Capgo server pushes the malicious bundle to all devices at once. No POC has been published, and the CVSS AC:H reflects the need to establish the MITM/server-control position first.