Is CVE-2026-56307 actively exploited?

No active exploitation of CVE-2026-56307 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-56307 be exploited remotely?

Yes. CVE-2026-56307 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-56307?

CVE-2026-56307 has a CVSS score of 4.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-56307

MEDIUM

CVE-2026-56307

CWE-670Published: June 20, 2026· Updated: Jun 22, 2026

4.3

CVSS v3.1

Official Description

Cap-go before 12.128.12 contains a broken cursor pagination vulnerability in the /private/devices endpoint on the Cloudflare/workerd path that allows authenticated attackers to cause duplicate-page loops and make later rows unreachable. Attackers with app.read_devices access can exploit non-advancing cursor filters to trigger infinite pagination loops, prevent dataset traversal, and cause repeated processing in device-management workflows.

NVD Source

Technical Analysis

CVE-2026-56307 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.