Missing Row-Level Security Policy in Capgo Affects Build Requests

CVE-2026-56334

What is CVE-2026-56334?

In versions prior to 12.128.2, Capgo lacks an UPDATE row-level security policy for the build_requests table. This oversight allows unauthorized API-key and anonymous access to disrupt the persistence of builder status updates. Without proper security measures in place, attackers can exploit this vulnerability, resulting in build request entries remaining in a pending state, often with null last_error values. Consequently, users may experience disrupted build processes, as status updates and error diagnostics are not properly recorded.

References