Is CVE-2026-56254 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56254 being exploited in the wild.

How severe is CVE-2026-56254?

High severity, with a CVSS score of 7, published 10 July 2026.

Which products and versions are affected?

Capgo Capacitor-Updater < 12.128.2.

Is there a fix for CVE-2026-56254?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-56254 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-56254?

Check whether you run Capgo Capacitor-Updater at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56254: Cap-go capacitor-updater encryption bypass via private key distribution

Q: Is there a fix for CVE-2026-56254?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-56254 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-56254?

Check whether you run Capgo Capacitor-Updater at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56254 · Severity: high · CVSS 7 · Published 2026-07-10

Cap-go capacitor-updater is a tool used by developers to push live updates to mobile applications. A security flaw in its encryption system allows unauthorized parties to potentially distribute malicious app updates to users' devices. This could occur if an attacker intercepts network traffic or compromises the update server, leading to the installation of fraudulent software that could steal data or disrupt app operations.

Vendors: Capgo.

Quick answers

Is CVE-2026-56254 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56254 being exploited in the wild.
How severe is CVE-2026-56254?: High severity, with a CVSS score of 7, published 10 July 2026.
Which products and versions are affected?: Capgo Capacitor-Updater < 12.128.2.
Is there a fix for CVE-2026-56254?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-56254 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-56254?: Check whether you run Capgo Capacitor-Updater at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in @capgo/capacitor-updater before version 12.128.2 due to improper key management (CWE-320). The end-to-end encryption implementation incorrectly distributes the private key to every device that downloads the application. Since the public key can be derived from this private key, an attacker capable of a man-in-the-middle (MITM) attack or a server-side compromise can generate validly signed update bundles. This allows the attacker to bypass integrity checks and force devices to install arbitrary, malicious updates. The issue is addressed in version 12.128.2.

Affected products

Cap-go capacitor-updater < 12.128.2

Timeline

2026-02-10: advisory: Initial GitHub Security Advisory published
2026-07-10: disclosed: CVE-2026-56254 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.