CVE-2026-56316 affects Cap-go prior to version 12.128.2. The vulnerability is an information disclosure issue in the OPTIONS /build/upload/:jobId/* endpoint, where unauthenticated attackers can enumerate valid builder job IDs by detecting observable discrepancies in responses. This can lead to unauthorized information disclosure and resource consumption through sustained unauthenticated traffic. No official patch or remediation level has been provided as of the published date.

The vulnerability allows unauthenticated attackers to enumerate valid builder job IDs, which constitutes information disclosure. Additionally, attackers can generate sustained unauthenticated traffic, potentially impacting resource availability. There is no indication of privilege escalation, code execution, or data modification from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is stated, users should monitor vendor communications for updates. Until a patch is available, consider restricting access to the affected endpoint or implementing rate limiting to reduce the risk of enumeration and resource exhaustion.