CVE-2026-56306: Capgo

Medium severity, CVSS 6.4. EPSS: 0.3% chance of exploitation in the next 30 days.

Capgo before 12.128.2 contains a weak parsing vulnerability in the x-limited-key-id header that allows attackers to bypass subkey enforcement by submitting malformed values, zero, or duplicate headers that result in NaN or falsy values. Remote attackers can manipulate the x-limited-key-id header to disable limited key scoping and execute requests using the main API key context instead of restricted subkey permissions.

Affected products

• Capgo Capgo: before 12.128.2 (fixed in 12.128.2)

Published 2026-06-22. Last modified 2026-06-23.