CVE-2026-56306

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.128.2

Description A weak parsing issue exists in the x-limited-key-id header. Remote attackers can bypass subkey enforcement by submitting duplicate headers, zero, or malformed values that result in falsy values or NaN (Not-a-Number, a value representing an undefined or unrepresentable numerical result). This allows the attacker to disable limited key scoping and execute requests using the main API key context instead of the restricted subkey permissions.

Recommendations Update to version 12.128.2 or later.