CVE-2026-56280

Name of the Vulnerable Software and Affected Versions Cap-go versions prior to 12.128.2

Description A privilege inversion issue exists in the 'GET /build/logs/:jobId' endpoint. This endpoint utilizes Server-Sent Events (SSE) to stream output and registers an abort listener that invokes the cancelBuildOnDisconnect() function using a privileged server-side BUILDER API KEY upon client disconnection. This process bypasses the app.build native permission check normally required by the 'POST /build/cancel/:jobId' endpoint. Consequently, users with read-only API keys can disrupt native build operations and CI/CD workflows by repeatedly opening the log stream and dropping the connection.

Recommendations Update to version 12.128.2 or later.