CVE-2026-56296 Cap-go CVE debrief

Who should care

Users of Cap-go before version 12.128.2 should be aware of this vulnerability and take steps to mitigate it. This vulnerability allows unauthenticated attackers to enumerate valid app IDs, which could lead to further unauthorized access or data breaches. Operators, platform administrators, vulnerability management teams, and security teams should review their deployments and take necessary actions to protect against this vulnerability.

Technical summary

The public.transfer_app RPC function in Cap-go before 12.128.2 returns different error messages for existing and non-existing app IDs. This can be exploited by unauthenticated attackers to enumerate valid app IDs by calling transfer_app with a publishable API key and observing the error messages. The vulnerability is due to the function's behavior of providing distinct error messages, which can be used to determine the existence of app IDs. This issue can be mitigated by updating to version 12.128.2 or later, restricting access to the public.transfer_app RPC function, and monitoring for suspicious activity related to app ID enumeration.

Defensive priority

Medium-High

Recommended defensive actions

• Update Cap-go to version 12.128.2 or later
• Restrict access to the public.transfer_app RPC function
• Monitor for suspicious activity related to app ID enumeration
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-11T14:16:21.683Z and has not been modified since then. The NVD entry is currently 6.9 MEDIUM. Limited information is available about the vulnerability, and further investigation is needed to fully understand the impact. The public.transfer_app RPC function returns distinct error messages for existing versus non-existing app IDs, allowing unauthenticated attackers to enumerate valid app IDs. The vendor has not provided additional details about the vulnerability. Users should verify their deployments and review the official CVE record for more information. Additional research is required to determine the full scope of the vulnerability and potential mitigations.

Official resources