CVE-2026-49135: CodexBar Insecure Temporary File Handling Allows Local Credential Theft

Technical summary

CVE-2026-49135 is an insecure temporary file handling vulnerability stemming from predictable file path generation in CodexBar's release notarization workflow. The vulnerability manifests through three attack vectors: (1) direct read access to App Store Connect API keys written to fixed paths, (2) time-of-check-time-of-use (TOCTOU) race conditions enabling symbolic link attacks and file pre-creation at predictable locations, and (3) tampering with notarization archives prior to submission to Apple's services. The root causes map to CWE-377 (Insecure Temporary File) and CWE-59 (Improper Link Resolution Before File Access), both stemming from inadequate entropy in temporary file naming and insufficient validation of file ownership and permissions.

Business impact

Compromise of App Store Connect credentials could allow attackers to publish malicious app updates, access analytics and user data, or revoke legitimate apps. Tampering with notarization archives before Apple submission can result in unsigned or maliciously modified applications reaching end users. For development teams and CI/CD operators, this represents a supply chain risk: attackers on shared build infrastructure can inject malware into release artifacts or exfiltrate signing credentials. Organizations using CodexBar for macOS or iOS release workflows face potential app store account takeover and reputational damage.

Affected systems

CodexBar versions prior to 0.32.0 are affected. The vulnerability affects any deployment where CodexBar is used for macOS or iOS application notarization and release workflows, particularly in multi-user or containerized build environments where multiple local users or processes have access to the same filesystem.

Exploitability

Exploitability is moderate to high for attackers with local access to the build system. The vulnerability requires local privileges (PR:L in the CVSS vector) but no user interaction and a straightforward attack complexity. On shared CI/CD runners, containerized build agents, or multi-tenant development machines, an unprivileged attacker or compromised process can execute the attack. However, the attack does require prior local presence on the target host; remote exploitation is not feasible.

Remediation

Upgrade CodexBar to version 0.32.0 or later immediately. The patched version addresses temporary file handling by using cryptographically secure temporary directories and validating file ownership before read or write operations. Organizations should also audit any API keys or credentials that may have been exposed during the window of vulnerability and rotate App Store Connect credentials if compromise is suspected.

Patch guidance

Apply CodexBar version 0.32.0 or later to all build systems, CI/CD pipelines, and developer machines currently running affected versions. Verify the update through the official CodexBar release channel and test in a non-production environment first to ensure compatibility with your release workflow. After patching, regenerate and rotate any App Store Connect API keys used during the vulnerability window as a precaution.

Detection guidance

Review CodexBar logs for unusual file access patterns in the temporary directory where notarization workflows execute (typically system temp directories). Look for symbolic links, hard links, or files created by unexpected users in locations where CodexBar writes temporary files. Monitor file integrity and permission changes in release artifact directories. If CodexBar is running in a CI/CD environment, check for unauthorized process execution or credential access attempts coinciding with release builds. Examine App Store Connect audit logs for unexpected API calls, key rotations, or account changes during the affected version's deployment period.

Why prioritize this

This vulnerability scores HIGH (CVSS 7.1) and poses direct supply chain and credential theft risks in development environments. While local-only exploitability somewhat constrains its scope, the ability to compromise App Store Connect credentials and inject malware into release artifacts makes it a critical priority for any organization using CodexBar. The vulnerability affects a foundational part of the release pipeline; compromise here cascades to end users.

Risk score, explained

The CVSS 3.1 score of 7.1 reflects high impact (confidentiality: H, integrity: H) with local attack vector and low attack complexity. The score does not require user interaction and affects only the confidentiality and integrity of data (availability: N), typical of temporary file and privilege escalation issues. The LOCAL attack vector and LOW privilege requirement prevent a CRITICAL rating, but the dual impact on credential theft and artifact tampering justifies HIGH severity.

Frequently asked questions