Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-56316 is an information disclosure vulnerability in Cap-go versions before 12.128.2. It exists in the OPTIONS /build/upload/:jobId/* endpoint, which is accessible without authentication.

This flaw allows unauthenticated attackers to determine whether specific builder job IDs exist by observing differences in the server's responses. For example, the endpoint returns different status codes and headers depending on whether the job ID is valid or not, effectively acting as an oracle.

Attackers can exploit this to enumerate valid job IDs without needing to authenticate, potentially generating sustained unauthenticated traffic.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers to enumerate valid builder job IDs without authentication, which may lead to information disclosure about your system's internal job identifiers.

Additionally, because the endpoint processes these unauthenticated requests with non-trivial latency, attackers could exploit it to generate sustained traffic, potentially causing resource consumption issues or denial-of-service conditions.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending unauthenticated OPTIONS requests to the /build/upload/:jobId/* endpoint and observing the differences in server responses.

Specifically, you can probe different job IDs and check the HTTP status codes and response headers:

• For non-existent job IDs, the server returns a 204 status code with TUS capability headers.
• For valid job IDs, the server returns a 404 JSON error.

A sample command using curl to test a job ID could be:

• curl -X OPTIONS https://your-capgo-instance/build/upload/<jobId>/ -i

By iterating over different job IDs and analyzing the response codes and headers, you can detect if the vulnerability is present.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include:

• Require authentication for the OPTIONS /build/upload/:jobId/* endpoint to prevent unauthenticated access.
• Implement static responses for OPTIONS requests to avoid observable discrepancies that reveal valid job IDs.
• Add rate limiting on this endpoint to mitigate potential denial-of-service or resource consumption attacks caused by sustained unauthenticated traffic.

Useful 0 Not Useful 0