Vulnerability · Published Jun 22, 2026 · Assigned by VulnCheck

CVE-2026-56221Cap-go - SQL Injection in Cloudflare Analytics Engine Queries via cloudflare.ts

Medium 6.5

In plain English

A medium-severity SQL injection in capgo from Cap-go. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 71.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Cap-go before 12.128.2 contains multiple SQL injection vulnerabilities in cloudflare.ts where user-controlled values from API request bodies are interpolated directly into SQL query strings without sanitization or parameterization. Authenticated users with read-level API key permissions can inject arbitrary SQL through deviceIds, search, version_name, cursor, and actions parameters to access analytics data belonging to other users or applications.

Affected products (as reported)

Vendor	Product	Versions
Cap-go	capgo	0 – before 12.128.2

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-f83x-p28r-pf74) vendor-advisory
VulnCheck Advisory: Cap-go - SQL Injection in Cloudflare Analytics Engine Queries via cloudflare.ts third-party-advisory