CVE-2026-56306: Capgo - Subkey Enforcement Bypass via x-limited-key-id Header Parsing
Capgo before 12.128.2 contains a weak parsing vulnerability in the x-limited-key-id header that allows attackers to bypass subkey enforcement by submitting malformed values, zero, or duplicate headers that result in NaN or falsy values. Remote attackers can manipulate the x-limited-key-id header to disable limited key scoping and execute requests using the main API key context instead of restricted subkey permissions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Capgoto a version that resolves this vulnerability.Fixed in 12.128.2
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker needs a valid main API key and the ability to send requests with a crafted x-limited-key-id header. The issue enables that key to be used outside the restrictions intended for a limited subkey.
Which header values can trigger the bypass?
The affected parsing accepts malformed values, zero, or duplicate x-limited-key-id headers when they produce NaN or another falsy value. These values can cause limited-key scoping to be skipped.
What is the impact of a successful bypass?
Requests execute in the main API key context rather than under the restricted permissions of the limited subkey. This can expose actions and data that the subkey was intended to limit.
What versions are affected?
Capgo versions before 12.128.2 are affected. Upgrading to 12.128.2 or later addresses the affected version range.