CVE-2026-56306 · Symaro Security Advisory

Description

Capgo before 12.128.2 contains a weak parsing vulnerability in the x-limited-key-id header that allows attackers to bypass subkey enforcement by submitting malformed values, zero, or duplicate headers that result in NaN or falsy values. Remote attackers can manipulate the x-limited-key-id header to disable limited key scoping and execute requests using the main API key context instead of restricted subkey permissions.

Severity (CVSS)

Base score	5.3
Severity	Medium
Version	CVSS 4.0
Vector	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Provided by	CNA

Weaknesses

CWE-20 — Improper Input Validation

Affected products

Vendor	Product	Versions
Capgo	Capgo	0 to <12.128.2; 12.128.2

References

https://github.com/Cap-go/capgo/security/advisories/GHSA-42vv-8j94-24wj (vendor-advisory)
https://www.vulncheck.com/advisories/capgo-subkey-enforcement-bypass-via-x-limited-key-id-header-parsing (third-party-advisory)

Authoritative sources

This page is a snapshot. For the latest enrichment and updates, view the record on CVE.org or the NVD.

Generated from the official CVE List on 23 Jun 2026 10:05 UTC.