CVE-2026-14898: OpenAI Codex macOS Image Fetching Information Disclosure

Technical summary

CVE-2026-14898 is an indirect prompt injection vulnerability in the OpenAI Codex macOS desktop application that leads to unintended information exfiltration. The vulnerability exists in the response-rendering layer, which automatically fetches remote images embedded in Markdown when processing model outputs. An attacker positioned to influence prompt content—through compromised tools, poisoned external data sources, or other indirect injection vectors—can cause the model to construct URLs that encode sensitive session data. The desktop app's automatic image-fetching behavior (no user interaction required) means the embedded credentials or secrets reach the attacker's server during the fetch operation. The attack surface includes any untrusted data fed into Codex prompts, including results from connected integrations.

Business impact

Organizations using Codex for code generation, documentation, or data analysis face credential exposure risk. Compromised API keys can lead to unauthorized access to OpenAI services and downstream systems. Exfiltrated source code creates intellectual property and security posture disclosure. If Codex is integrated with other tools (databases, version control, deployment systems), connected-tool results become an attack vector that could leak data from those systems as well. The lack of UI friction (no click required) increases the likelihood that users remain unaware of the exfiltration, delaying detection and response.

Affected systems

The OpenAI Codex desktop application for macOS is directly affected. The vendor_products list in the advisory is empty, which suggests either the vendor has not formally listed affected versions or the vulnerability details are still under coordination. Users should verify with OpenAI's official advisory for specific version ranges affected by this issue.

Exploitability

Exploitation requires an attacker to place an indirect prompt injection in content that will be processed by Codex—such as output from a connected tool, a code repository, or another untrusted source integrated into the workflow. The CVSS vector (AV:N/AC:L/PR:N/UI:R) reflects network-accessible attack, low complexity, and user interaction (the user must cause the Codex app to render the malicious response). The user interaction requirement is met once the user sends a prompt; the automatic image fetch requires no additional clicks. No direct integrity or availability impact and no known wild exploitation lower the severity to MEDIUM, but the potential for high confidentiality impact warrants attention.

Remediation

Users should immediately update Codex to a patched version provided by OpenAI. Check OpenAI's official security advisories and release notes for the specific version that remedies this vulnerability. The primary mitigation is preventing automatic fetching of remote images in Markdown responses—users should verify that their installed version includes this fix. Until patched, organizations should audit which external data sources and tool integrations feed prompts into Codex and reduce reliance on untrusted inputs in production workflows.

Patch guidance

Apply the latest OpenAI Codex desktop app update for macOS as released by OpenAI in response to CVE-2026-14898. Verify the patched version against OpenAI's official security bulletin to confirm the image-fetching behavior has been hardened or disabled. Organizations should test the update in a non-production environment before rolling out to ensure compatibility with dependent workflows. Enable automatic updates if available to reduce the window of exposure.

Detection guidance

Monitor Codex sessions for unexpected outbound HTTPS requests to unfamiliar domains, particularly during or immediately after response rendering. Check application logs and network traffic for evidence of image-fetch requests containing encoded data or unusual URL patterns. Review Codex interaction history for prompts containing injected markdown image syntax, especially from integrated external tools. Inspect any API key or secret rotation logs to identify whether credentials accessed during Codex sessions have been misused. Organizations with endpoint detection and response (EDR) tools should look for the Codex app making network requests to non-OpenAI infrastructure during normal operation.

Why prioritize this

Although the CVSS score is MEDIUM (6.5), the practical confidentiality impact is high: API keys, source code, and tool-returned data represent critical assets. The low barrier to exploitation (network-accessible, no special privileges required) combined with the silent nature of the exfiltration (automatic image fetch, no user visibility) justifies urgent patching. The absence of known wild exploitation provides a narrow window to patch before adversaries weaponize the technique. Organizations where Codex is connected to production systems or processes sensitive source code should prioritize this patch above routine updates.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects high confidentiality impact and low attack complexity, balanced against the user-interaction requirement and lack of direct integrity or availability damage. The network-accessible attack vector and the simplicity of crafting indirect prompt injections keep the attack complexity low. The score appropriately captures the risk for users but may underweight the business risk in organizations where Codex handles proprietary code or integrates with sensitive tool chains. Security teams should consider their own environment's exposure when deciding on patch priority independent of the base CVSS score.

Frequently asked questions