PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-56306 Capgo CVE debrief

CVE-2026-56306 is a medium-severity vulnerability in Capgo, a product of Unknown Vendor, which has a weak parsing vulnerability in the x-limited-key-id header. This vulnerability allows remote attackers to bypass subkey enforcement by submitting malformed values, zero, or duplicate headers that result in NaN or falsy values. As a result, attackers can manipulate the x-limited-key-id header to disable limited key scoping and execute requests using the main API key context instead of restricted subkey permissions. The vulnerability has a CVSS score of 5.3 and was published on June 22, 2026. The CVE record was last modified on June 23, 2026.

Vendor
Capgo
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-22
Original CVE updated
2026-06-23
Advisory published
2026-06-22
Advisory updated
2026-06-23

Who should care

Security teams and administrators responsible for Capgo installations should be aware of this vulnerability. Given the medium severity and potential for exploitation, defenders should prioritize assessment and remediation efforts. Organizations using Capgo should verify their installations and update to a patched version if available.

Technical summary

The vulnerability exists in the x-limited-key-id header parsing mechanism of Capgo. Specifically, the code fails to properly handle malformed or duplicate headers, leading to NaN or falsy values. Attackers can exploit this weakness to bypass subkey enforcement, allowing them to execute requests with elevated privileges. The vulnerability is characterized by a CVSS:4.0 vector of AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability in their Capgo installations. Given the medium severity, it is essential to assess the risk and implement compensating controls if a patch is not immediately available.

Recommended defensive actions

  • Assess Capgo installations for vulnerability to CVE-2026-56306
  • Update Capgo to version 12.128.2 or later if available
  • Implement compensating controls to restrict access to the x-limited-key-id header
  • Monitor for suspicious activity related to the x-limited-key-id header
  • Verify API key usage and subkey permissions

Evidence notes

The CVE record and NVD detail provide official information about the vulnerability. Additional sources, including Vulncheck and GitHub advisories, offer further context and potential mitigations. However, the exact scope of affected Capgo installations and the vendor's remediation workflow are not explicitly stated in the provided sources.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-56306 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-56306

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-56306 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-56306

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.