CVE-2026-49134: CodexBar < 0.32.0 Privilege Escalation via CLI Installer Temp File

Synopsis

A privilege escalation vulnerability exists in the CLI installer of CodexBar prior to version 0.32.0. The installer creates a temporary file using mktemp, writes a privileged shell payload into it, and then executes it as root; a local attacker running as the same user can overwrite that temporary file in the window between creation and execution, causing attacker-controlled commands to run as root. A patched-image rebuild at version 0.32.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network for the initial attack surface to apply, per AV:N in the CVSS vector.

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker must already have a local session as the same user running the installer, per PR:L.

• Victim interactionRequired

  The legitimate user must take an action, specifically approving the administrator privilege prompt during the installer run, providing the exploitation window, per UI:P.

• Attack complexityDetail

  Exploitation depends on winning a race condition between the temp file write and the privileged execution step, meaning timing and environmental factors affect reliability, per AC:H.

Blast Radius

• A successful attacker executes arbitrary commands as root on the host running the installer.
• Full read access to all files and secrets on the system is gained, including credentials, keys, and sensitive application data (VC:H).
• The attacker can modify or delete any file on the system, including binaries, configuration, and persisted data (VI:H).
• The attacker can terminate or disrupt any process on the host, bringing down services entirely (VA:H).