Cap-go - Job Existence Oracle via Unauthenticated OPTIONS /build/upload/:jobId/*
Description
Cap-go before 12.128.2 contains an information disclosure vulnerability in the OPTIONS /build/upload/:jobId/* endpoint that allows unauthenticated attackers to enumerate valid builder job IDs through observable response discrepancies. Attackers can probe the endpoint without authentication to distinguish valid job IDs from invalid ones and generate sustained unauthenticated traffic for resource consumption.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
Root cause
"Missing authentication on the OPTIONS /build/upload/:jobId/* endpoint allows unauthenticated callers to distinguish valid builder job IDs from invalid ones via different HTTP responses."
Attack vector
An unauthenticated attacker sends an HTTP OPTIONS request to `/build/upload/:jobId/*` with a candidate job ID. If the job ID is invalid, the endpoint returns HTTP 204 with TUS capability headers; if the job ID is valid, it returns HTTP 404 with a JSON `not_found` body [ref_id=1]. This observable discrepancy (CWE-203) allows attackers to enumerate valid builder job IDs without any authentication. The endpoint also shows non-trivial latency (0.3–0.9s), enabling sustained unauthenticated traffic for resource consumption (CWE-400) [ref_id=1].
Affected code
The advisory identifies `supabase/functions/_backend/public/build/index.ts` and `supabase/functions/_backend/public/build/upload.ts` as the affected files. The route `app.options('/upload/:jobId/*', ...)` in `index.ts` calls `tusProxy()` without requiring authentication (no `middlewareKey`), and `tusProxy()` in `upload.ts` queries `build_requests` by `builder_job_id`, returning different responses for valid vs. invalid job IDs [ref_id=1].
What the fix does
The advisory recommends requiring authentication for the OPTIONS route by applying `middlewareKey(['all','write'])` or equivalent, or handling OPTIONS locally without proxying to `tusProxy` (returning static TUS capability headers) combined with IP-based rate limiting [ref_id=1]. Either approach closes the information disclosure by eliminating the observable response discrepancy and removes the unauthenticated load surface.
Preconditions
- authNo authentication required; the endpoint is publicly reachable.
- networkAttacker must be able to send HTTP OPTIONS requests to the API endpoint.
Generated on Jun 22, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2- github.com/Cap-go/capgo/security/advisories/GHSA-9c2x-7h5x-37gmmitrevendor-advisory
- www.vulncheck.com/advisories/cap-go-job-existence-oracle-via-unauthenticated-options-build-upload-jobidmitrethird-party-advisory
News mentions
0No linked articles in our index yet.