CVE-2026-56329

5.3 mediumEPSS 0.3%

Medium (5.3). EPSS 0.3% chance of exploitation in the next 30 days.

Capgo before 12.128.2 contains a cross-tenant preview namespace collision vulnerability caused by non-bijective decoding of double underscores to dots in preview hostname parsing. Attackers can register app IDs with underscores that collide with other tenants' dotted app IDs, causing preview misrouting and denial of preview access for victim applications.

Severity

CVSS 4.0

5.3 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L

CVSS 3.1

6.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-31)
CWE: CWE-436
Published: 2026-07-10
Modified: 2026-07-10
Record from: the NVD, synced 2026-10-19

References

https://github.com/Cap-go/capgo/security/advisories/GHSA-76qq-gg2p-pwwj
https://www.vulncheck.com/advisories/capgo-cross-tenant-preview-namespace-collision-via-non-bijective-underscore-decoding
https://github.com/Cap-go/capgo/security/advisories/GHSA-76qq-gg2p-pwwj

Check your stack JSON