Is CVE-2026-100614 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-100614 being exploited in the wild.

How severe is CVE-2026-100614?

High severity, with a CVSS score of 8.8, published 26 September 2026.

Is there a fix for CVE-2026-100614?

A patch was published on 2026-09-26: Fixed in version 12.244.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-100614 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-100614?

Check whether you run Cap-go Capgo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-100614: Capgo metadata-cleaning worker cross-tenant image overwrite

CVE-2026-100614 · Severity: high · CVSS 8.8 · Published 2026-09-26

Capgo is an application deployment and update platform that stores user and application images in cloud storage. An authenticated attacker can modify image metadata for other organizations or users by exploiting a worker service that does not verify image ownership before processing uploads. This allows silent changes to cross-tenant image metadata, potentially altering how applications or organizations appear to end users.

Technologies: Cap-go Capgo. Vendors: Cap-go.

Quick answers

Is CVE-2026-100614 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-100614 being exploited in the wild.
How severe is CVE-2026-100614?: High severity, with a CVSS score of 8.8, published 26 September 2026.
Which products and versions are affected?: Cap-go Capgo before 12.244.1.
Is there a fix for CVE-2026-100614?: A patch was published on 2026-09-26: Fixed in version 12.244.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-100614 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-100614?: Check whether you run Cap-go Capgo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A database trigger routes image updates to an internal metadata-cleaning worker that constructs a privileged Supabase client using SUPABASE_SERVICE_ROLE_KEY. The worker accepts image keys from mutable database rows without validating that the key belongs to the row's owner, allowing an authenticated user to place another tenant's known image key into a row they control. The worker then downloads, sanitizes, and re-uploads the victim's image with changed metadata bytes, bypassing storage access controls through a confused-deputy attack pattern.

Affected products

Cap-go Capgo before 12.244.1

Timeline

2026-09-26: disclosed: CVE-2026-100614 and GHSA-rcrw-pg2v-j9xg published
2026-09-26: patched: Fixed in version 12.244.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.