PT-2026-51226 · Cap Go · Cap-Go
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Cap-go versions prior to 12.128.2
Description
An information disclosure issue exists in the 'OPTIONS /build/upload/:jobId/*' endpoint. Unauthenticated attackers can enumerate valid builder job IDs by observing response discrepancies. This allows attackers to distinguish valid job IDs from invalid ones and generate sustained unauthenticated traffic, leading to resource consumption. The vulnerable variable is
jobId.Recommendations
Update to version 12.128.2 or later.
Exploit
Fix
Side Channel Attack
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cap-Go