---
id: CVE-2026-56316
title: >-
  Cap-go - Job Existence Oracle via Unauthenticated OPTIONS
  /build/upload/:jobId/*
summary: >-
  Cap-go before 12.128.2 contains an information disclosure vulnerability in the
  OPTIONS /build/upload/:jobId/* endpoint that allows unauthenticated attackers
  to enumerate valid builder job IDs through observable response discrepancies.
  At…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-203
vendor: Cap-go
product: capgo
affected:
  - capgo < 12.128.2
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-06-24T17:56:11.814088Z'
exploitAvailable: true
published: '2026-06-21'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:05:57.968Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-56316'
references:
  - url: 'https://github.com/Cap-go/capgo/security/advisories/GHSA-9c2x-7h5x-37gm'
    label: GitHub Security Advisory (GHSA-9c2x-7h5x-37gm)
  - url: >-
      https://www.vulncheck.com/advisories/cap-go-job-existence-oracle-via-unauthenticated-options-build-upload-jobid
    label: >-
      VulnCheck Advisory: Cap-go - Job Existence Oracle via Unauthenticated
      OPTIONS /build/upload/:jobId/*
tags:
  - cve.org
  - exploit-available
epss: 0.00311
epssPercentile: 0.24105
ingestedAt: '2026-11-08T14:51:22.358Z'
---

## Overview

Cap-go before 12.128.2 contains an information disclosure vulnerability in the OPTIONS /build/upload/:jobId/* endpoint that allows unauthenticated attackers to enumerate valid builder job IDs through observable response discrepancies. Attackers can probe the endpoint without authentication to distinguish valid job IDs from invalid ones and generate sustained unauthenticated traffic for resource consumption.

## Affected

- `capgo < 12.128.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.