Is CVE-2026-56280 actively exploited?

No active exploitation of CVE-2026-56280 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-56280 be exploited remotely?

Yes. CVE-2026-56280 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-56280?

CVE-2026-56280 has a CVSS score of 7.1 (HIGH).

HOME VULNERABILITIESCVE-2026-56280

HIGH

CVE-2026-56280

CWE-862Published: June 22, 2026· Updated: Jun 24, 2026

7.1

CVSS v3.1

EPSS:0.26%probability of exploitation in 30 daysPercentile:17.3th

Official Description

Cap-go before 12.128.2 contains a privilege inversion vulnerability in GET /build/logs/:jobId that allows read-only API key holders to cancel running native builds. The endpoint registers an abort listener on the SSE stream that unconditionally invokes cancelBuildOnDisconnect() using the privileged server-side BUILDER_API_KEY when clients disconnect, bypassing the app.build_native permission check required by the explicit POST /build/cancel/:jobId endpoint. Attackers with read-only API keys can repeatedly disrupt native build operations and CI/CD workflows by opening the log stream and dropping the connection.

NVD Source

Technical Analysis

CVE-2026-56280 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in availability disruption (denial of service), with a CVSS base score of 7.1.