PT-2026-54038 · Cap Go · Cap-Go

Judel777 · Published 2026-06-30 · Updated 2026-07-01 · CVE-2026-56334

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description Capgo lacks an UPDATE row-level security policy for the build requests table. This missing policy prevents API-key and anonymous access from persisting builder status updates. An attacker can exploit this to ensure build status and error details are not saved, which results in build requests rows remaining in a pending state with null last error values.

Recommendations Update to version 12.128.2.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-56334

Affected Products

Cap-Go

References · 4

• https://github.com/Cap-go/capgo/security/advisories/GHSA-gc46-h5j6-qp6q · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56334 · Security Note
• https://vulncheck.com/advisories/capgo-missing-update-rls-policy-for-build-status-persistence · Note
• https://twitter.com/VulmonFeeds/status/2072181387038200047 · Twitter Post