CVE-2026-56296 Cap-go - App Existence Oracle via Unauthenticated transfer_app RPC
Unauthenticated attackers can enumerate valid application IDs by observing distinct error messages from the transfer_app RPC endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-56296?
CVE-2026-56296 is a medium-severity vulnerability in Cap-go capgo, published on 11 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Cap-go before 12.128.2 contains an information disclosure vulnerability in the public.transfer_app RPC function that returns distinct error messages for existing versus non-existing app IDs. Unauthenticated attackers can enumerate valid app IDs by observing error message differences when calling transfer_app with only the publishable API key.
Weakness: CWE-203
Which versions are affected by CVE-2026-56296?
How do I fix CVE-2026-56296?
No fix has been published for CVE-2026-56296 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-56296 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56296 exists.
Sources
Also known as GHSA-fcmv-mqrc-fr3c, GHSA-fmm3-3qcg-85j6.