PT-2026-57553 · Cap Go · Cap-Go

Offset · Published 2026-07-12 · Updated 2026-07-12 · CVE-2026-56281

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description An issue exists in the 'POST /private/admin stats' endpoint where the limit parameter is extracted from an unvalidated request body and inserted directly into Cloudflare Analytics Engine SQL queries using template literals. An attacker with platform admin credentials can use this to inject SQL fragments, allowing them to enumerate dataset schemas, extract analytics data, or cause a denial-of-service against the analytics backend.

Recommendations Update to version 12.128.2 or later. Avoid using the limit parameter in the 'POST /private/admin stats' endpoint until the update is applied.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-56281

Affected Products

Cap-Go

References · 5

• https://github.com/Cap-go/capgo/security/advisories/GHSA-6ffx-8hjj-jhhf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56281 · Security Note
• https://twitter.com/infoflowcloud/status/2076341062361080001 · Twitter Post
• https://vulncheck.com/advisories/capgo-sql-injection-via-unvalidated-limit-parameter-in-admin-stats-endpoint · Note
• https://twitter.com/CVEnew/status/2076339915340546545 · Twitter Post