CVE-2026-49135: CodexBar < 0.32.0 Insecure Temporary File Handling in Notarization Workflow

Synopsis

Insecure temporary file handling in CodexBar, a release notarization workflow tool, allows a local attacker with a low-privilege account on the same host to read credentials or tamper with build artifacts. The vulnerability stems from predictable file paths written during the notarization process, enabling symlink attacks and pre-creation of files at those paths. Successful exploitation gives an attacker access to the App Store Connect API key or the ability to redirect notarization archives to attacker-controlled destinations. A patched-image rebuild at version 0.32.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure is required.

• AuthenticationRequired

  Any low-privilege local account on the host is sufficient; no elevated or administrative rights are needed.

• Victim interactionNot required

  No action from another user is required; the attacker can exploit predictable paths independently.

• Attack complexityDetail

  Base exploit steps are condition-free, though the CVSS v4.0 vector notes an attack target prerequisite (AT:P), meaning the attacker must wait for or trigger the notarization workflow to be active.

Blast Radius

• Reads the App Store Connect API key written to a fixed temporary path, giving the attacker credentials to interact with the App Store Connect API.
• Pre-creates files or symbolic links at predictable locations to redirect archive writes to attacker-controlled destinations.
• Tampers with notarization archives before submission, allowing injection of malicious content into the release artifact.
• Confidentiality and integrity of the host-local build process are both compromised; the running service itself is not disrupted.