API Key Privilege Escalation via Insufficient Rotation Validation

Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikey_manager to rotate a higher-privileged org_super_admin sibling key and recover its plaintext credential. Attackers with apikey_manager role can enumerate same-owner API keys, rotate a stronger sibling through the PUT endpoint, and obtain the replacement plaintext secret to authenticate as the higher-privileged principal.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Cap-go capgo.app versions before 12.267.1 contain a critical privilege escalation vulnerability in API key rotation functionality. The flaw allows attackers with the lower-privileged apikey_manager role to enumerate sibling API keys belonging to the same organization and rotate higher-privileged org_super_admin keys without proper authorization checks. Upon successful rotation, attackers receive the plaintext credential of the newly rotated key, enabling complete account takeover with elevated permissions. This vulnerability affects any organization using Cap-go that grants apikey_manager permissions to untrusted or compromised accounts, creating a direct path for lateral privilege escalation and unauthorized administrative access.

Casky's 224 mapped skills detect the attack patterns behind this CVE by analyzing indicators across MITRE ATT&CK Technique TA0004 (Privilege Escalation). Claude AI with extended reasoning identifies the tell-tale signs practitioners should monitor: suspicious API key rotation requests originating from lower-privileged service accounts, enumeration patterns where apikey_manager roles query multiple organizational API keys, PUT requests to key rotation endpoints that modify higher-privileged credentials, and authentication events using recently rotated keys from unexpected sources. Practitioners using Casky would see correlated findings showing the progression from privilege enumeration through unauthorized modification to credential recovery—allowing them to distinguish this sophisticated escalation attack from routine key management operations and respond before attackers establish persistent high-privilege access.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-100615.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-100615

Casky has 224 skills that investigate the attack patterns behind CVE-2026-100615. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn