CVE-2026-56334: Capgo - Missing UPDATE RLS Policy for Build Status Persistence
Capgo before 12.128.2 lacks an UPDATE row-level security policy for the buildrequests table, preventing API-key and anonymous access from persisting builder status updates. Attackers can exploit this missing policy to cause build status and error details to remain unpersisted, leaving buildrequests rows stuck in pending state with null lasterror values.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Capgoto a version that resolves this vulnerability.Fixed in 12.128.2 - Compensating control
If upgrading is not immediately possible, add the missing UPDATE row-level security (RLS) policy for the build_requests table so API-key and anonymous access can persist builder status updates (preventing build_requests rows from remaining stuck in pending with null last_error).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56334?
The severity of CVE-2026-56334 is classified as medium with a score of 5.3.
How do I fix CVE-2026-56334?
To fix CVE-2026-56334, implement an UPDATE row-level security policy for the build_requests table in Capgo.
What impacts does CVE-2026-56334 have on Capgo users?
CVE-2026-56334 can allow attackers to exploit the absence of an UPDATE policy, leading to unpersisted build status updates.
Which versions of Capgo are affected by CVE-2026-56334?
CVE-2026-56334 affects Capgo versions prior to 12.128.2.
Can anonymous users exploit CVE-2026-56334?
Yes, CVE-2026-56334 allows both API-key and anonymous users to exploit the missing UPDATE row-level security policy.