CVE-2026-56316 — Cap-go - Job Existence Oracle via Unauthenticated OPTIONS /build/upload/:jobId/*
Cap-go before 12.128.2 contains an information disclosure vulnerability in the OPTIONS /build/upload/:jobId/* endpoint that allows unauthenticated attackers to enumerate valid b…
Published: 2026-06-21 · CVSS: 6.9 · CVSS 4.0
Cap-go before 12.128.2 contains an information disclosure vulnerability in the OPTIONS /build/upload/:jobId/* endpoint that allows unauthenticated attackers to enumerate valid builder job IDs through observable response discrepancies. Attackers can probe the endpoint without authentication to distinguish valid job IDs from invalid ones and generate sustained unauthenticated traffic for resource consumption.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7