CVE-2026-49135

Name of the Vulnerable Software and Affected Versions CodexBar versions prior to 0.32.0

Description Insecure temporary file handling in the release notarization workflow allows local attackers to access sensitive credentials or tamper with build artifacts. This is possible by exploiting predictable file paths, enabling attackers on the same host to read the App Store Connect API key written to a fixed path. Additionally, attackers can pre-create files or symbolic links at predictable locations to redirect writes to attacker-controlled destinations or modify notarization archives before they are submitted.

Recommendations Update CodexBar to version 0.32.0 or later.