@Capgo/Capacitor-Updater (Cap-Go/Capgo) (Before 12.128.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/@capgo/capacitor-updater-cap-go/capgo-before-12.128.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 10 Jul 2026 15:21:10 +0000Capacitor Updater Vulnerability Allows Malicious Update Installation via Private Key Distributionhttps://feed.craftedsignal.io/briefs/2026-07-capacitor-updater-key-distro/Fri, 10 Jul 2026 15:21:10 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-capacitor-updater-key-distro/A vulnerability, CVE-2026-56254, in @capgo/capacitor-updater (Cap-go/capgo) before version 12.128.2 allows an attacker to create and distribute validly signed malicious application updates by leveraging the improper distribution of a private key to each client device, enabling man-in-the-middle or server compromise scenarios.CVE-2026-56254 impacts the @capgo/capacitor-updater component in Cap-go/capgo, versions prior to 12.128.2. This vulnerability stems from a flaw in the end-to-end encryption scheme where the private key used for signing updates is distributed to every device that downloads the application. Since the public key can be derived from this private key, an attacker who can perform a man-in-the-middle attack or compromise the Capgo server can sign and distribute their own malicious update bundles. This allows them to bypass the legitimate update mechanism and cause devices to install unauthorized software, granting them control over the affected applications and potentially the underlying devices. The primary concern for defenders is the integrity of application updates, as compromised updates can lead to further system compromise, data exfiltration, or persistence.

Attack Chain

  1. An attacker performs reconnaissance to identify applications using @capgo/capacitor-updater with versions before 12.128.2.
  2. The attacker either compromises the Capgo server hosting legitimate application updates or positions themselves to execute a man-in-the-middle (MiTM) attack against a target device.
  3. The attacker intercepts or accesses the private key, which is improperly distributed to client devices as part of the application's functionality.
  4. Using the compromised private key, the attacker crafts a malicious update bundle containing arbitrary code or a backdoored version of the application.
  5. The attacker signs the malicious update bundle using the unlawfully obtained private key, making it appear legitimate to vulnerable client applications.
  6. During an update check, the attacker delivers the validly signed malicious update bundle to the target device, either through the compromised Capgo server or via a MiTM interception.
  7. The client application, unable to distinguish the malicious update from a genuine one due to the valid signature, downloads and installs the unauthorized update.
  8. The malicious update executes, achieving the attacker's objective, such as arbitrary code execution, data exfiltration, or persistent access on the compromised device.

Impact

Successful exploitation of CVE-2026-56254 enables an attacker to deliver unauthorized and potentially malicious updates to applications utilizing @capgo/capacitor-updater. This bypasses the intended security mechanisms for application integrity and supply chain trust. The direct consequences can range from denial of service if updates are corrupted, to full compromise of the application or the underlying device if the malicious update contains harmful code. This could lead to sensitive data exposure, unauthorized access to user accounts, or the installation of additional malware. The scope of impact is potentially wide, affecting all users of applications built with vulnerable versions of @capgo/capacitor-updater.

Recommendation

  • Patch CVE-2026-56254 immediately by updating @capgo/capacitor-updater to version 12.128.2 or later as indicated in the GitHub advisory linked in the references.
  • Review application build and deployment processes to ensure that private keys are managed securely and not distributed to client-side components.
  • Implement robust network monitoring for unusual traffic patterns to and from application update servers to detect potential man-in-the-middle activity.
]]>highadvisorysupply-chainvulnerabilitycode-signingsoftware-update