CVE-2026-100614

Executive Summary

CVE-2026-100614 is a cross-tenant integrity vulnerability in the Capgo metadata-cleaning worker present in versions before 12.244.1. An authenticated attacker can supply another tenant's image object key in database rows they control, causing the service-role worker to process (download and re-upload) the victim's object with sanitized metadata, bypassing storage access controls via a confused-deputy pattern. With a CVSS base score of 8.8, successful exploitation silently corrupts metadata integrity across tenant boundaries; no public exploit code is known and Capgo is not listed in CISA KEV.

Technical Analysis

The vulnerability resides in a background "metadata-cleaning worker" that runs with service-role privileges. According to the NVD description, this worker "trusts image object keys from mutable database rows without validating ownership." The core defect is an authorization/ownership-validation failure (CWE-639 — Authorization Bypass Through User-Controlled Key) combined with a confused-deputy condition: the worker holds elevated credentials (service role) but acts on object keys supplied by lower-privileged, user-modifiable data.

The attack surface is the update path for database rows that reference image objects. An authenticated user can write a victim tenant's image object key into a row under their own control. When the worker subsequently processes that row, it treats the key as legitimate and, because it operates with service-role permissions, downloads the referenced object and re-uploads it with "sanitized metadata." Because the object key is not bound to the caller's tenant, the worker's privileged access is redirected to an object the attacker is not authorized to modify — effectively a cross-tenant write.

The vulnerability class is authorization bypass through user-controlled key with a confused-deputy escalation: the security boundary (tenant ownership of an object) is enforced neither at row-write time nor at worker-processing time. The result is a silent integrity violation — no direct confidentiality read of image content is described, but the worker's download/upload lifecycle provides an indirect path to metadata modification. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates network-reachable, low-complexity exploitation requiring low privileges (an authenticated account) with no user interaction, and high confidentiality and integrity impact but no availability impact. Note the CVSS scope is Unchanged despite the cross-tenant effect; the integrity impact is confined to the metadata layer of affected objects.

Insufficient technical detail is available in the public description to identify specific function names, API endpoints, parameter names, or the exact database schema involved; no such specifics are asserted here.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class and the NVD description.

1. Reconnaissance / target identification: The attacker obtains an authenticated account on the affected Capgo deployment (low privileges are sufficient per PR:L). The attacker identifies a target tenant whose image objects they wish to modify, and determines — or already knows — that tenant's image object key (the NVD description states the attacker "suppl[ies] known victim keys").

2. Triggering the flaw: Through a normal, authorized row update, the attacker writes the victim tenant's image object key into a database row they control. This is an ordinary write the attacker is permitted to perform; the flaw is that the backend does not validate that the object key belongs to the attacker's tenant.

3. Execution via the confused-deputy worker: The service-role metadata-cleaning worker later processes the attacker-controlled row. Trusting the key without an ownership check, the worker uses its elevated service-role credentials to download the victim's image object and re-upload it with sanitized metadata. The attacker never directly touches the victim's storage object; the privileged worker performs the cross-tenant operation on the attacker's behalf.

4. Post-exploitation impact: The victim tenant's image object metadata is silently modified. Because the modification is metadata-only and executed through a trusted internal worker, it can evade storage access controls and may go unnoticed. Severity is elevated by the stealth of the operation and the trust boundary crossed (service role acting on behalf of a low-privileged user against another tenant).

Impact Assessment

Business impact centers on multi-tenant data integrity and tenant isolation. A successful attack lets an authenticated user silently alter metadata of another tenant's image objects, undermining the trust model that tenants rely on for data separation. CVSS subscores: Confidentiality High (C:H), Integrity High (I:H), Availability None (A:N), Scope Unchanged, Attack Vector Network, Attack Complexity Low, Privileges Required Low, User Interaction None. Blast radius is bounded by the number of object keys an attacker can enumerate or guess for target tenants; the impact is integrity/confidentiality of metadata rather than data destruction. Because exploitation requires only a low-privileged account and the malicious action is performed by the service worker, detection is difficult and the affected population extends to every tenant on a vulnerable deployment. No CISA KEV listing and no known in-the-wild exploitation were reported at the time of writing.

Detection Guidance

Sigma Rule

title: Capgo Metadata Worker Cross-Tenant Object Key Abuse (CVE-2026-100614)
id: 9f3a1c2e-7b4d-4e21-9a10-capgo100614
status: experimental
description: Detects database row updates that write object keys not owned by the updating tenant, potentially triggering the confused-deputy metadata-cleaning worker.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100614
author: valtersit.com
date: 2026/01/01
logsource:
  product: capgo
  service: application
detection:
  selection_event:
    event_type:
      - 'db.row.update'
      - 'image.metadata.clean'
  selection_key_mismatch:
    object_key_owner_tenant|ne: actor_tenant_id
  condition: selection_event and selection_key_mismatch
falsepositives:
  - Legitimate cross-tenant administrative operations
  - Internal migrations moving objects between tenants
level: high
tags:
  - attack.t1190
  - cve.2026.100614

YARA Rule

rule CVE_2026_100614_Capgo_CrossTenant_Metadata
{
    meta:
        description = "Detects Capgo metadata-cleaning worker cross-tenant object key abuse patterns in logs or artifacts"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100614"
        cve = "CVE-2026-100614"
        date = "2026-01-01"
    strings:
        $worker = "metadata-cleaning worker" ascii nocase
        $svc    = "service-role" ascii nocase
        $objkey = "object_key" ascii nocase
        $tenant = "tenant_id" ascii nocase
        $cve    = "CVE-2026-100614" ascii
    condition:
        uint16(0) == 0x7B0D or (any of ($worker, $svc, $objkey)) or $cve
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100614 Capgo cross-tenant image object key update attempt"; flow:established,to_server; http.method; content:"PATCH"; http.uri; content:"image"; http.request_body; content:"object_key"; http.request_body; pcre:"/object_key\"?\s*[:=]\s*\"?[^\"&]*(tenant|bucket)?/Ri"; classtype:attempted-user; sid:2026100614; rev:1; metadata:created_at 2026_01_01, cve CVE_2026_100614;)

Elastic Detection

// Detects potential Capgo cross-tenant object key manipulation (CVE-2026-100614)
sequence by user.id
  [ database where event.action == "row.update" and object_key != null ]
  [ database where event.action == "image.metadata.clean" and
      object_key_owner_tenant != user.tenant_id ]

Splunk SPL Query

index=capgo sourcetype=capgo:app "object_key"
| search ("row.update" OR "metadata.clean" OR "service-role")
| rex field=object_key "^(?<key_tenant>[^/]+)/"
| where key_tenant != actor_tenant_id
| stats count min(_time) as first_seen max(_time) as last_seen by actor_tenant_id key_tenant object_key
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="capgo,cve-2026-100614,">
  <rule id="100614" level="12">
    <decoded_as>json</decoded_as>
    <field name="event_type">row\.update|image\.metadata\.clean</field>
    <field name="object_key">\.</field>
    <description>CVE-2026-100614: Possible Capgo cross-tenant image object key manipulation by service-role worker.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cross_tenant,integrity,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source; no vendor advisory, workaround, or OSV package data available in the provided intelligence).

1. Immediate mitigations:

• Enforce ownership validation at the application layer so that any object key written into a database row is verifiable as belonging to the authenticated tenant.
• Constrain the metadata-cleaning worker so it cannot operate on objects outside the requesting tenant's namespace (re-authorize immediately before the worker downloads/re-uploads).
• Restrict or audit low-privileged accounts able to write object keys into rows, and monitor for cross-tenant key references.
• Disable or rate-limit the metadata-cleaning worker until ownership checks are in place, if operationally feasible.

2. Patch/upgrade steps:

• Upgrade to Capgo 12.244.1 or later, which per the NVD description addresses the trusted-key issue. Verify the vendor's release notes directly, as no advisory was present in the tracked sources.
• After upgrade, re-validate that the worker enforces tenant ownership on object keys before processing.

3. Long-term hardening:

• Apply tenant scoping to all service-role operations and adopt a "never trust client-provided keys" design principle.
• Implement row-level security so that an actor cannot persist another tenant's object keys.
• Add continuous detection for cross-tenant key references and service-role worker anomalies (see Detection Guidance).

References

• NVD — CVE-2026-100614: https://nvd.nist.gov/vuln/detail/CVE-2026-100614
• CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• FIRST EPSS (score not yet assigned at time of writing): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-100614 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, Nuclei template, threat-actor campaign, or exploit-in-the-wild evidence was identified in the provided intelligence. Capgo version 12.244.1 is the referenced fix.