CVE-2026-56248

Executive Summary

CVE-2026-56248 is an unauthenticated denial-of-service (DoS) vulnerability in the Cap-go capgo-backend application, affecting versions prior to 12.128.12. The vulnerability resides in the audit_logs table's Row-Level Security (RLS) policy when accessed via the Supabase PostgREST API. An attacker can exploit this by sending unfiltered queries to the public.audit_logs endpoint using the public anon key, causing the PostgreSQL query planner to execute costly logic before RLS rejection. This consistently triggers statement timeouts (PostgREST error 57014) and, under concurrency, exhausts database resources, leading to cascading HTTP 500 failures on unrelated endpoints (e.g., /orgs). The result is an application-layer denial of service.

Supply Chain & Package Security

This vulnerability affects the capgo-backend package, which is part of the Cap-go ecosystem. The package is likely distributed via npm or similar registries. Organizations using Cap-go should verify their dependency version and update to 12.128.12 or later to mitigate this issue. No known supply chain compromise has been reported, but the unauthenticated nature of the attack increases the risk of exploitation in public-facing deployments.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)

Threat Level: High. The vulnerability is remotely exploitable without authentication, requires no user interaction, and can cause a complete denial of service to the application.

Deep Dive & Mechanics

The vulnerability is rooted in the interaction between Supabase's PostgREST API and PostgreSQL's Row-Level Security (RLS) policies. The audit_logs table has an RLS policy that is intended to restrict access to authorized users. However, the PostgreSQL query planner executes costly logic (e.g., joins, aggregations, or complex filtering) before the RLS policy rejects the query. When an unauthenticated request is made to the public.audit_logs endpoint using the public anon key, the database still processes the query's expensive operations before applying the RLS filter. This results in statement timeouts (PostgREST error 57014) for each request.

Under concurrency (multiple simultaneous requests), the database resources (CPU, memory, connection pool) are exhausted, causing cascading failures on other endpoints (e.g., /orgs). This leads to HTTP 500 errors across the application, effectively denying service to legitimate users.

Key Technical Details:

• Affected Component: public.audit_logs endpoint via Supabase PostgREST API.
• Attack Vector: Unauthenticated HTTP requests with the public anon key.
• Root Cause: Inefficient RLS policy design that allows costly query execution before access control.
• Impact: Database resource exhaustion and application-layer DoS.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-12.128.12): The RLS policy on the audit_logs table likely uses a function or subquery that performs expensive operations before checking the user's role. For example:

CREATE POLICY audit_logs_policy ON public.audit_logs
  FOR SELECT
  USING (
    -- Expensive logic executed before RLS rejection
    (SELECT COUNT(*) FROM some_large_table) > 0
    AND auth.role() = 'authenticated'
  );

Patched Code (12.128.12+): The fix restructures the RLS policy to perform cheap checks first, preventing costly operations for unauthorized users. For example:

CREATE POLICY audit_logs_policy ON public.audit_logs
  FOR SELECT
  USING (
    auth.role() = 'authenticated'
    AND (SELECT COUNT(*) FROM some_large_table) > 0
  );

Additionally, the patch may introduce query timeouts or rate limiting at the API gateway level.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running capgo-backend version < 12.128.12.
• Public anon key (often exposed in client-side code or API documentation).

Exploitation Steps:

1. Identify the target's Supabase PostgREST endpoint (e.g., https://target.supabase.co/rest/v1/audit_logs).
2. Obtain the public anon key (e.g., from a JavaScript bundle or API docs).
3. Send a simple GET request to the endpoint:

   curl -X GET "https://target.supabase.co/rest/v1/audit_logs" \
     -H "apikey: YOUR_ANON_KEY" \
     -H "Authorization: Bearer YOUR_ANON_KEY"
   

4. Observe the response time (should be high) and eventual timeout (error 57014).
5. For DoS, launch concurrent requests using a tool like ab or wrk:

   ab -n 100 -c 10 "https://target.supabase.co/rest/v1/audit_logs?apikey=YOUR_ANON_KEY"
   

6. Monitor the target's /orgs endpoint for HTTP 500 errors.

Expected Outcome: Database resource exhaustion, cascading failures on other endpoints, and application unavailability.

Blue Team (Defense & Detection)

Detection:

• Monitor for high response times on the audit_logs endpoint.
• Alert on repeated PostgREST error 57014 (statement timeout).
• Track concurrent requests to audit_logs from a single IP or user agent.

Mitigation:

• Apply the patch (upgrade to 12.128.12+).
• Implement rate limiting on the audit_logs endpoint.
• Use a Web Application Firewall (WAF) to block anomalous traffic.
• Restrict the public anon key's permissions to only necessary tables.

Indicators of Compromise (IOCs)

• Network:

  • High volume of requests to /rest/v1/audit_logs with the public anon key.
  • HTTP 500 responses on unrelated endpoints (e.g., /orgs).
  • PostgREST error 57014 in API responses.

• Logs:

  • PostgreSQL logs showing statement timeouts on audit_logs queries.
  • Supabase logs indicating repeated RLS policy evaluations.

• System:

  • Elevated database CPU and memory usage.
  • Connection pool exhaustion.

Detection Engineering

YARA Rule

rule CVE_2026_56248_DoS_Detection {
    meta:
        description = "Detects exploitation attempts for CVE-2026-56248 via audit_logs endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-56248"
    strings:
        $endpoint = "/rest/v1/audit_logs"
        $anon_key = "apikey" nocase
        $error_57014 = "57014"
    condition:
        $endpoint and $anon_key and $error_57014
}

Sigma Rule

title: CVE-2026-56248 - Unauthenticated DoS via audit_logs Endpoint
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects repeated statement timeouts on the audit_logs endpoint, indicating exploitation of CVE-2026-56248.
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: supabase
detection:
    selection:
        endpoint: "/rest/v1/audit_logs"
        response_code: 57014
    condition: selection
falsepositives:
    - Legitimate high-load scenarios
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-56248 - Unauthenticated DoS via audit_logs"; flow:to_server; content:"/rest/v1/audit_logs"; http_uri; content:"apikey"; http_header; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade capgo-backend to version 12.128.12 or later.
2. If immediate upgrade is not possible, implement a WAF rule to block requests to /rest/v1/audit_logs from unauthenticated sources.
3. Apply rate limiting on the audit_logs endpoint (e.g., 10 requests per minute per IP).

Long-Term Measures:

• Review all RLS policies for expensive operations that execute before access control.
• Implement query timeouts at the database level to prevent resource exhaustion.
• Use a CDN or API gateway to absorb DoS traffic.
• Monitor database performance metrics and set alerts for anomalies.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.