Capgo EUVD-2026-38120

No special conditions are required - the /replication endpoint accepts unauthenticated HTTP requests in all default configurations of Capgo versions before 12.128.2. The CVSS 4.0 vector (PR:N, AC:L, AT:N) confirms zero privilege and zero complexity requirements. Exploitation is limited to deployments where the Capgo backend HTTP service is reachable from the attacker's network; instances protected behind a firewall or restricted to internal-only access face substantially reduced exposure. Impact is bounded exclusively to information disclosure - the endpoint does not accept writes, cannot be used for SQL injection, and does not expose application user data or authentication credentials directly.

The CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) correctly characterizes this as a network-accessible, zero-complexity, unauthenticated information disclosure with low confidentiality impact to the vulnerable system and no integrity or availability consequences. The impact is confined to reconnaissance value: WAL LSN positions reveal replication topology, lag between primary and standby nodes, and slot lifecycle state; error messages may disclose database version or configuration. EPSS data was not provided in the available intelligence, so probabilistic exploitation likelihood cannot be quantified. However, the attack requires only a single HTTP request to a known endpoint path - automatable at scale against internet-scanning infrastructure. The absence of a CISA KEV listing and confirmed POC code limits urgency somewhat, but the trivial exploitation path means any internet-exposed Capgo instance should be treated as at practical risk. Real-world impact is bounded by the disclosure-only nature: this vulnerability does not enable direct data exfiltration from application tables, code execution, or service disruption - it is a reconnaissance enabler, not a standalone high-impact vector.

An attacker performing reconnaissance against internet-facing infrastructure identifies a publicly reachable Capgo instance and issues an unauthenticated HTTP GET request to the /replication endpoint. The server responds with JSON containing PostgreSQL replication slot names, current WAL LSN positions, and any recent database error messages, allowing the attacker to map the replication topology, identify standby nodes, and estimate data volume for use in planning deeper attacks against the database infrastructure. No public proof-of-concept code has been identified at time of analysis, though the attack requires no specialized tooling beyond a standard HTTP client.