Is CVE-2026-56307 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56307 being exploited in the wild.

How severe is CVE-2026-56307?

Medium severity, with a CVSS score of 4.3, published 20 June 2026.

Is there a fix for CVE-2026-56307?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-56307 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-56307?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56307: Cap-go broken cursor pagination in /private/devices endpoint

CVE-2026-56307 · Severity: medium · CVSS 4.3 · Published 2026-06-20

Cap-go, a tool for managing app updates and devices, contains a flaw in how it handles lists of devices on its Cloudflare-hosted infrastructure. An authorized user can trigger a loop that prevents them from seeing all registered devices, instead receiving the same data repeatedly. This can disrupt administrative workflows, cause automated management tools to hang or crash, and prevent the export of complete device datasets.

Quick answers

Is CVE-2026-56307 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56307 being exploited in the wild.
How severe is CVE-2026-56307?: Medium severity, with a CVSS score of 4.3, published 20 June 2026.
Which products and versions are affected?: Cap-go capgo < 12.128.12.
Is there a fix for CVE-2026-56307?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-56307 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-56307?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A broken cursor pagination vulnerability exists in the /private/devices endpoint of Cap-go when running on the Cloudflare/workerd path. The root cause is an incorrect implementation of the cursor filter in `readDevicesCF()`, where the `nextCursor` fails to advance correctly during dataset traversal. An authenticated attacker with `app.read_devices` permissions can exploit this by replaying the returned cursor, which results in duplicate pages and `hasMore=true` remaining set indefinitely. This leads to a denial-of-service condition for device management workflows, as later rows in the dataset become unreachable and client-side iteration may loop infinitely. The issue was fixed in version 12.128.12.

Affected products

Cap-go capgo < 12.128.12

Timeline

2026-05-08: advisory: Vendor advisory published on GitHub
2026-06-20: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.