CVE-2026-100614: Capgo before 12.244.1 Cross-Tenant Image Overwrite via Metadata Worker
Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image object keys from mutable database rows without validating ownership. An authenticated attacker can place a victim tenant's image key in a row they control, causing the service-role worker to download and re-upload that object with sanitized metadata. Attackers can silently modify metadata in cross-tenant image objects by supplying known victim keys during authorized row updates, bypassing storage access controls through the confused-deputy metadata worker.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Capgoto a version that resolves this vulnerability.Fixed in 12.244.1
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attacker must be authenticated and able to perform authorized updates to rows they control. They also need to know an image object key belonging to another tenant.
Which deployments are exposed to cross-tenant impact?
Deployments running Capgo versions before 12.244.1 are affected where the metadata-cleaning worker processes mutable database rows containing image object keys. The issue is relevant in multi-tenant environments because a tenant-controlled row can reference another tenant's known image key.
What is the practical impact of successful exploitation?
An attacker can cause the service-role metadata worker to download and re-upload a victim tenant's image with sanitized metadata. This can silently alter metadata on cross-tenant image objects despite storage access controls.