---
id: CVE-2026-56282
title: Capgo - Information Disclosure via Unauthenticated /replication Endpoint
summary: >-
  Capgo before 12.128.2 contains an information disclosure vulnerability in the
  unauthenticated /replication endpoint that exposes internal PostgreSQL
  replication telemetry including slot names and WAL LSN positions. Attackers
  can access t…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-200
vendor: Capgo
product: Capgo
affected:
  - Capgo < 12.128.2
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-06-23T02:32:29.269636Z'
exploitAvailable: true
published: '2026-06-20'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:05:53.879Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-56282'
references:
  - url: 'https://github.com/Cap-go/capgo/security/advisories/GHSA-q6gm-xfwr-44f5'
    label: GitHub Security Advisory (GHSA-q6gm-xfwr-44f5)
  - url: >-
      https://www.vulncheck.com/advisories/capgo-information-disclosure-via-unauthenticated-replication-endpoint
    label: >-
      VulnCheck Advisory: Capgo - Information Disclosure via Unauthenticated
      /replication Endpoint
tags:
  - cve.org
  - exploit-available
epss: 0.00396
epssPercentile: 0.34079
ingestedAt: '2026-11-08T14:51:22.360Z'
---

## Overview

Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /replication endpoint that exposes internal PostgreSQL replication telemetry including slot names and WAL LSN positions. Attackers can access this endpoint without authentication to retrieve sensitive infrastructure details such as replication slot names, confirmed_flush_lsn, restart_lsn values, and database error messages for reconnaissance purposes.

## Affected

- `Capgo < 12.128.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.