A privilege inversion vulnerability in Cap-go allows unauthorized users to cancel CI/CD builds, creating a risk of service disruption.

This is a privilege inversion vulnerability located in the GET /build/logs/:jobId endpoint. The application improperly uses a privileged server-side API key when handling client disconnections, allowing users with only read-only access to invoke administrative build cancellation functions.

With a CVSS score of 7.1, this flaw poses a significant operational risk. By bypassing permission checks, an unauthorized actor can disrupt critical CI/CD pipelines, resulting in a denial-of-service for build infrastructure and potentially delaying time-to-market for software updates.

Immediate Action: Update the Cap-go installation to version 12.128.2 or later to correct the API key handling logic.

Proactive Monitoring: Review access logs for the GET /build/logs/:jobId endpoint to identify any unauthorized or unusual cancellation activity during build processes.

Compensating Controls: Restrict access to the build management interface at the network level and ensure that API keys are rotated if unauthorized access is suspected.

Public Exploit Available: false

The ability for low-privileged users to disrupt CI/CD operations is a severe security oversight for development environments. It is strongly recommended to apply the patch to version 12.128.2 immediately to restore proper access control enforcement.