PT-2026-51402 · Cap Go · Cap-Go

Publicado 2026-06-22 · Atualizado 2026-06-22 · CVE-2026-56221

NVD

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Cap-go before 12.128.2 contains multiple SQL injection vulnerabilities in cloudflare.ts where user-controlled values from API request bodies are interpolated directly into SQL query strings without sanitization or parameterization. Authenticated users with read-level API key permissions can inject arbitrary SQL through deviceIds, search, version name, cursor, and actions parameters to access analytics data belonging to other users or applications.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-56221

Produtos afetados

Cap-Go

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-56221 · Nota de Segurança
• https://github.com/Cap-go/capgo/security/advisories/GHSA-f83x-p28r-pf74 · Aviso do Fabricante
• https://vulncheck.com/advisories/cap-go-sql-injection-in-cloudflare-analytics-engine-queries-via-cloudflare-ts · Nota