Security Control Bypass in Capgo by Capgo

CVE-2026-56243

What is CVE-2026-56243?

Capgo prior to version 12.128.2 is vulnerable to a security control bypass that affects the enforcement of hashed API keys. In this vulnerability, the PostgREST/RLS plane erroneously accepts plaintext API keys through the capgkey header, even when the enforce_hashed_api_keys setting is enabled. This flaw permits attackers to bypass organizational-level hashed key enforcement measures by submitting plaintext API keys directly, leading to potential unauthorized access to sensitive resources.

References