Is there a patch available for CVE-2026-56282?

Yes, a patch is available for CVE-2026-56282. Update the affected software to the latest version immediately.

Capgo CVE-2026-56282

Q: What is the CVSS score of CVE-2026-56282?

CVE-2026-56282 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38120 MEDIUM

Information Exposure (CWE-200)

2026-06-20 VulnCheck

GHSA-6fvp-3fgp-7pvf

Information Disclosure PostgreSQL Capgo

6.9

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network-reachable unauthenticated endpoint with no complexity, leaking only internal PostgreSQL replication metadata - low confidentiality impact, no integrity or availability impact, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 06:19 vuln.today

Patch available

Jun 20, 2026 - 17:16 EUVD

DescriptionCVE.org

Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /replication endpoint that exposes internal PostgreSQL replication telemetry including slot names and WAL LSN positions. Attackers can access this endpoint without authentication to retrieve sensitive infrastructure details such as replication slot names, confirmed_flush_lsn, restart_lsn values, and database error messages for reconnaissance purposes.

AnalysisAI

Unauthenticated access to Capgo's /replication HTTP endpoint exposes internal PostgreSQL replication telemetry to any remote attacker, affecting all versions prior to 12.128.2. Attackers can retrieve replication slot names, WAL LSN positions (confirmed_flush_lsn, restart_lsn), and database error messages without supplying any credentials, enabling database infrastructure reconnaissance. No public exploit code or CISA KEV listing exists at time of analysis, but the zero-complexity unauthenticated attack vector makes opportunistic scanning against internet-exposed Capgo deployments trivially feasible.

Technical ContextAI

Capgo is an open-source live-update backend for Capacitor mobile applications, built on a PostgreSQL foundation using a Supabase-style architecture. The affected component is an HTTP endpoint (/replication) that surfaces PostgreSQL logical replication metadata - specifically slot names, confirmed_flush_lsn (the LSN through which replication has been acknowledged), restart_lsn (the oldest LSN the server must retain in WAL), and any database-generated error messages. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) applies because the endpoint lacks authentication middleware, making internal replication topology details accessible to any network-reachable client. This metadata can reveal replication lag, slot count, subscriber topology, and potentially database version details via error messages. Affected products are identified under CPE cpe:2.3:a:capgo:capgo:*:*:*:*:*:*:*:*, covering all releases from version 0 up to but not including 12.128.2.

RemediationAI

Upgrade Capgo to version 12.128.2 or later, which is the vendor-released patch per the GitHub Security Advisory GHSA-q6gm-xfwr-44f5 (https://github.com/Cap-go/capgo/security/advisories/GHSA-q6gm-xfwr-44f5). For deployments that cannot immediately apply the patch, place a reverse proxy or API gateway in front of the Capgo service and configure it to return HTTP 401 or 403 for all requests targeting the /replication path from untrusted sources - this requires no application changes but introduces a dependency on proxy availability. Alternatively, if Capgo is not required to be internet-facing, restrict access to the service to internal network segments or VPN-only ingress via firewall rules, eliminating the unauthenticated remote attack vector entirely with no functional impact to authenticated application users. Neither workaround addresses the underlying missing authentication on the endpoint, so patching to 12.128.2+ remains the definitive fix.