PT-2026-57428 · Cap Go · Cap-Go

Judel777 · Published 2026-07-11 · Updated 2026-07-11 · CVE-2026-56296

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Cap-go versions prior to 12.128.2

Description An information disclosure issue exists in the public.transfer app RPC function. Unauthenticated attackers can enumerate valid app IDs by observing differences in error messages returned when calling the function using only the publishable API key, which reveals whether an app ID exists or not.

Recommendations Update Cap-go to version 12.128.2 or later.

Exploit

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

Related Identifiers

CVE-2026-56296

GHSA-FMM3-3QCG-85J6

Affected Products

Cap-Go

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56296.json · Exploit
• https://github.com/Cap-go/capgo/security/advisories/GHSA-fmm3-3qcg-85j6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-56296 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56296 · Security Note
• https://twitter.com/infoflowcloud/status/2076042887347818582 · Twitter Post
• https://twitter.com/CVEnew/status/2076040502466548089 · Twitter Post
• https://vulncheck.com/advisories/cap-go-app-existence-oracle-via-unauthenticated-transfer-app-rpc · Note