PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-56221 Cap-go CVE debrief

CVE-2026-56221 is a high-severity vulnerability in Cap-go, a cloudflare analytics engine. The vulnerability exists in the cloudflare.ts file, where user-controlled values from API request bodies are interpolated directly into SQL query strings without sanitization or parameterization. This allows authenticated users with read-level API key permissions to inject arbitrary SQL and access analytics data belonging to other users or applications. The vulnerability has a CVSS score of 7.1 and is classified as HIGH. The CVE was published on 2026-06-22T22:16:50.670Z and last modified on 2026-06-23T14:52:58.543Z.

Vendor
Cap-go
Product
capgo
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-22
Original CVE updated
2026-06-23
Advisory published
2026-06-22
Advisory updated
2026-06-23

Who should care

Organizations using Cap-go before version 12.128.2 should be aware of this vulnerability and take immediate action to remediate. Specifically, administrators of Cap-go instances with exposed analytics engines, security teams monitoring for potential SQL injection attacks, and developers integrating Cap-go with other applications should prioritize patching and monitoring.

Technical summary

The vulnerability exists in the cloudflare.ts file of Cap-go, where user-controlled values from API request bodies are interpolated directly into SQL query strings without sanitization or parameterization. This allows authenticated users with read-level API key permissions to inject arbitrary SQL through deviceIds, search, version_name, cursor, and actions parameters. The vulnerability can be exploited to access analytics data belonging to other users or applications.

Defensive priority

High priority should be given to patching Cap-go instances to version 12.128.2 or later. In the meantime, defenders can implement additional monitoring and logging to detect potential SQL injection attacks.

Recommended defensive actions

  • Patch Cap-go instances to version 12.128.2 or later
  • Implement additional monitoring and logging to detect potential SQL injection attacks
  • Restrict API access to only necessary users and applications
  • Use parameterized queries or prepared statements to prevent SQL injection
  • Regularly review and update Cap-go configurations to ensure security best practices are followed

Evidence notes

The CVE-2026-56221 vulnerability was reported by Vulncheck and has been confirmed by the Cap-go development team. The vulnerability affects Cap-go versions before 12.128.2. The CVE has a CVSS score of 7.1 and is classified as HIGH.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-56221 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-56221

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-56221 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-56221

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.