Capgo CVE-2026-56316

No special conditions are required beyond network access to the Capgo instance - the vulnerable OPTIONS endpoint is exposed by default on all pre-12.128.2 installations and requires no authentication (PR:N per CVSS 4.0 vector). The endpoint /build/upload/:jobId/* must be reachable from the attacker's network, meaning internet-exposed deployments face the broadest exposure while air-gapped or strictly firewalled instances are protected by network controls alone. Exploitation is limited to confidentiality of job IDs; no authentication credentials, file contents, or build artifacts are directly accessible through this vector. The resource consumption impact is bounded by the target's capacity to handle unauthenticated OPTIONS requests, and no user interaction or privileged configuration is required.

The CVSS 4.0 base score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) reflects moderate real-world risk. The attack vector is fully network-accessible with no authentication, no special attack conditions, and no user interaction required, which makes exploitation trivially automatable at scale - any internet-exposed Capgo instance is a valid target. The confidentiality impact is scored Low (VC:L) because only job IDs are disclosed rather than job content or credentials, but job ID knowledge can serve as reconnaissance to target subsequent operations. The description also notes sustained unauthenticated traffic for resource consumption, though this is not reflected in the availability scoring (VA:N), suggesting the DoS component is incidental rather than reliable. No EPSS data was provided in the intelligence set, and the vulnerability is not listed in CISA KEV. Given the trivial exploitation bar and the information-disclosure-enabling-further-attack pattern, this should be treated as a patching priority for any internet-facing Capgo deployment, even if the raw confidentiality impact appears limited.

An unauthenticated attacker iterates through candidate job ID values by sending OPTIONS requests to /build/upload/{jobId}/ against an internet-exposed Capgo instance, observing response status codes or headers to distinguish valid from invalid IDs. Within minutes of automated probing, the attacker compiles a list of active builder job IDs that can be used to target subsequent authenticated operations or monitor build pipeline activity for sensitive timing information. No public proof-of-concept exploit code has been identified, but the technique requires no specialized tooling beyond a standard HTTP client.