CVE-2026-56329

mediumCVSS 6.4covered by 1 sourcefirst seen 2026-07-10

Capgo before 12.128.2 contains a cross-tenant preview namespace collision vulnerability caused by non-bijective decoding of double underscores to dots in preview hostname parsing. Attackers can register app IDs with underscores that collide with other tenants' dotted app IDs, causing preview misrouting and denial of preview access for victim applications.

⚡ Watch CVE-2026-56329

Get an email if CVE-2026-56329 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

mediumCVE-2026-56329: Capgo before 12.128.2 contains a cross-tenant preview namespace collision vulnerability caused…nvd · 2026-07-10

External references

NVD record for CVE-2026-56329

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-56329 status](https://www.csirts.com/badge/CVE-2026-56329)](https://www.csirts.com/cve/CVE-2026-56329)