Executive Summary

CVE-2026-56307 is a broken cursor pagination vulnerability in the /private/devices endpoint of the Cap-go platform running on the Cloudflare/workerd runtime path. The issue causes the pagination cursor to fail to advance properly, resulting in the same device being repeatedly returned with a hasMore=true flag. This creates an infinite loop that prevents access to later rows in the dataset, even though those rows exist.

Authenticated users with app.read_devices access can exploit this flaw to trigger duplicate page loops, making some data unreachable and causing repeated processing in device-management workflows. The root cause is related to the Cloudflare-specific implementation of cursor filtering and ordering logic in the readDevicesCF() function.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by causing infinite pagination loops when accessing device data, which prevents traversal of the full dataset. As a result, some device records become unreachable and cannot be processed or managed properly.

It can lead to repeated processing of the same data pages, potentially causing inefficiencies or errors in device-management workflows. Although it does not allow unauthorized access or data exposure across tenants, it affects the integrity and availability of device enumeration.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by observing the behavior of the /private/devices endpoint when accessed by an authenticated user with app.read_devices permissions. Specifically, if pagination requests repeatedly return the same device data with the same cursor and the hasMore=true flag, causing an infinite loop and preventing access to later rows, this indicates the presence of the broken cursor pagination issue.

To detect this on your system, you can perform authenticated API calls to the /private/devices endpoint and monitor the pagination cursor values and returned data. If the cursor does not advance and the same data is returned repeatedly, the vulnerability is present.

Example commands might include using curl or similar tools to paginate through the devices endpoint while logging cursor values and responses, for example:

• curl -H "Authorization: Bearer <token>" "https://<your-capgo-instance>/private/devices?cursor=<cursor_value>"
• Check if the cursor value in the response remains the same across requests and if hasMore=true persists without advancing.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the Cap-go package to version 12.128.12 or later, where this broken cursor pagination vulnerability has been patched.

Until the upgrade can be applied, restrict or monitor access to the /private/devices endpoint, especially for users with app.read_devices permissions, to reduce the risk of exploitation.

Useful 0 Not Useful 0