PT-2026-51152 · Cap Go · Cap-Go
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Capgo versions prior to 12.128.2
Description
An information disclosure issue exists in the unauthenticated '/replication' endpoint. This allows attackers to retrieve internal PostgreSQL replication telemetry without authentication, exposing sensitive infrastructure details such as replication slot names,
confirmed flush lsn, restart lsn values, and database error messages for reconnaissance purposes.Recommendations
Update to version 12.128.2 or later.
As a temporary workaround, restrict access to the '/replication' endpoint to minimize the risk of exploitation.
Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cap-Go