PT-2026-51402 · Cap Go · Cap-Go

Published 2026-06-22 · Updated 2026-06-22 · CVE-2026-56221

NVD

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Cap-go before 12.128.2 contains multiple SQL injection vulnerabilities in cloudflare.ts where user-controlled values from API request bodies are interpolated directly into SQL query strings without sanitization or parameterization. Authenticated users with read-level API key permissions can inject arbitrary SQL through deviceIds, search, version name, cursor, and actions parameters to access analytics data belonging to other users or applications.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-56221

Affected Products

Cap-Go

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-56221 · Security Note
• https://github.com/Cap-go/capgo/security/advisories/GHSA-f83x-p28r-pf74 · Vendor Advisory
• https://vulncheck.com/advisories/cap-go-sql-injection-in-cloudflare-analytics-engine-queries-via-cloudflare-ts · Note