Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Cap-go before 12.128.2 contains a privilege inversion vulnerability in GET /build/logs/:jobId that allows read-only API key holders to cancel running native builds. The endpoint registers an abort listener on the SSE stream that unconditionally invokes cancelBuildOnDisconnect() using the privileged server-side BUILDER_API_KEY when clients disconnect, bypassing the app.build_native permission check required by the explicit POST /build/cancel/:jobId endpoint. Attackers with read-only API keys can repeatedly disrupt native build operations and CI/CD workflows by opening the log stream and dropping the connection.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Your read-only API key can cancel production builds. CVE-2026-56280 in Cap-go: GET /build/logs/:jobId streams output over SSE but also registers an abort listener. No permission check. Read scope becomes destroy scope. Here's what to check Wednesday:
Post summary
The message discloses a privilege‑escalation flaw in Cap‑go where a read‑only API key can cancel builds due to a missing permission check on the logs endpoint.