CVE-2026-56243

Capgo - Hashed API Key Enforcement Bypass via PostgREST/RLS Plane

Published Jun 23, 2026 CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Description

Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plaintext API keys through the capgkey header despite enforce_hashed_api_keys being enabled. Attackers can bypass org-level hashed-key enforcement by sending plaintext API keys directly to the PostgREST/RLS plane to access protected resources.

Analysis

Technical impact

The flaw allows attackers to send plaintext API keys to the PostgREST/RLS plane even when hashed-key enforcement is enabled, bypassing organizational restrictions and enabling unauthorized access to protected resources. This is an authentication bypass (CWE‑288) that compromises the integrity and confidentiality of any data accessed through Capgo.

Affected Systems

Capgo prior to version 12.128.2 is vulnerable. Users operating Capgo installations below 12.128.2, especially those relying on PostgREST/RLS plane for API key enforcement, are susceptible.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.6, indicating high severity. No EPSS data is available and the flaw is not listed in the CISA KEV catalog. Although the attack requires remote HTTP access to the Capgo service and knowledge of a valid API key, the ability to bypass enforcement grants attackers immediate unauthorized access, making it a compelling target for attackers.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Capgo

unaffected

Version	Status	Constraints
`0`	affected	< 12.128.2
`12.128.2`	unaffected	—

No data.

Vendor Product Versions

Cap-go

Version	Status	Scheme	Platform
`[0,12.128.2)`	affected	semver	—
`12.128.2`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to Capgo version 12.128.2 or later, which removes the bypass.
Verify that the enforce_hashed_api_keys setting is enabled on the PostgREST/RLS plane and that it is properly validated.
Conduct a review of access logs to detect any use of plaintext API keys and apply network restrictions to limit access to the PostgREST/RLS endpoint to trusted sources.
As an interim measure, disable or remove the capgkey header acceptance logic until the update is applied.

Generated by OpenCVE AI on June 23, 2026 at 13:26 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.346% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/Cap-go/capgo/security/advisories/GHSA-6g74-8cpq-g2c8
https://www.vulncheck.com/advisories/capgo-hashed-api-key-enforcement-bypass-via-postgrest-rls-plane

History

Jun 24, 2026 4:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Cap-go Cap-go cap-go
Vendors & Products		Cap-go Cap-go cap-go

Jun 23, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Jun 23, 2026 12:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Capgo before 12.128.2 contains a security control bypass vulnerability where the PostgREST/RLS plane accepts plaintext API keys through the capgkey header despite enforce_hashed_api_keys being enabled. Attackers can bypass org-level hashed-key enforcement by sending plaintext API keys directly to the PostgREST/RLS plane to access protected resources.
Title		Capgo - Hashed API Key Enforcement Bypass via PostgREST/RLS Plane
Weaknesses		CWE-288
References		https://github.com/Cap-go/capgo/security/advisories/GHSA-6g74-8cpq-g2c8 https://www.vulncheck.com/advisories/capgo-hashed-api-key-enforcement-bypass-via-postgrest-rls-plane
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}` cvssV4_0 `{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}`