CVE-2026-56248

Summary

Cap-go capgo (capgo-backend) before 12.128.12 contains an unauthenticated denial-of-service vulnerability arising from the audit_logs table's Row-Level Security (RLS) policy when accessed via the Supabase PostgREST API. Because the PostgreSQL query planner executes costly logic before RLS rejection, unfiltered queries to the public.audit_logs endpoint using the public anon key consistently trigger statement timeouts (PostgREST error 57014). Under concurrency, this exhausts database resources and causes cascading HTTP 500 failures on unrelated endpoints (e.g. /orgs), resulting in an application-layer denial of service.

Affected Software

Weaknesses

• CWE-400: Uncontrolled Resource Consumption

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: yes
  • Technical Impact: partial

Additional References

• https://github.com/Cap-go/capgo/security/advisories/GHSA-5vgv-rqj5-5748

References

• https://github.com/Cap-go/capgo/security/advisories/GHSA-5vgv-rqj5-5748
• https://www.vulncheck.com/advisories/capgo-unauthenticated-denial-of-service-via-audit-logs-rls-policy

• ←Previous
• Next→