CVE-2026-56316
Medium · 5.3CVSS
5.3
EPSS
0.4%
Published
Jun 21, 2026
CISA due date
—
The record
Cap-go before 12.128.2 contains an information disclosure vulnerability in the OPTIONS /build/upload/:jobId/* endpoint that allows unauthenticated attackers to enumerate valid builder job IDs through observable response discrepancies. Attackers can probe the endpoint without authentication to distinguish valid job IDs from invalid ones and generate sustained unauthenticated traffic for resource consumption.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-88834 A flaw was found in BusyBox's httpd web server. CWE-203
- CVE-2026-87620 Observable discrepancy in SVG in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-203
- CVE-2026-87623 Observable discrepancy in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-203
- CVE-2026-87619 Observable discrepancy in Prefetch in Google Chrome prior to 153.0.8010.36 allowed a… CWE-203
- CVE-2026-87566 Observable discrepancy in Layout in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-203
- CVE-2026-87539 Observable discrepancy in Network in Google Chrome prior to 153.0.8010.36 allowed a… CWE-203
- CVE-2026-87516 Observable discrepancy in Navigation in Google Chrome prior to 153.0.8010.36 allowed a… CWE-203
- CVE-2026-87518 Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 153.0.8010.36… CWE-203