Capgo - Subkey Enforcement Bypass via x-limited-key-id Header Parsing | Advisories

Advisories

Capgo - Subkey Enforcement Bypass via x-limited-key-id Header Parsing

severity: medium
date: 6/22/2026
Affecting: Capgo >= 0, < 12.128.2
CVE: CVE-2026-56306
CWE: CWE-20 Improper Input Validation
CVSS: 5.3
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
References: GitHub Security Advisory (GHSA-42vv-8j94-24wj)
Credit: Judel777
Description: Capgo before 12.128.2 contains a weak parsing vulnerability in the x-limited-key-id header that allows attackers to bypass subkey enforcement by submitting malformed values, zero, or duplicate headers that result in NaN or falsy values. Remote attackers can manipulate the x-limited-key-id header to disable limited key scoping and execute requests using the main API key context instead of restricted subkey permissions.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo