CVE-2026-56307

score

<0.1

cvss

4.3

epss

0.4%

published

2026-06-20

kev added

—

first seen

2026-10-21

Cap-go < 12.128.12 contains a broken access control vulnerability caused by non-advancing cursor filters in /private/devices endpoint on Cloudflare/workerd path, letting authenticated attackers with app.read_devices access cause infinite pagination loops.