Is CVE-2026-49135 actively exploited?

No active exploitation of CVE-2026-49135 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-49135 be exploited remotely?

No. CVE-2026-49135 requires local access to exploit.

What is the CVSS score of CVE-2026-49135?

CVE-2026-49135 has a CVSS score of 7.1 (HIGH).

HOME VULNERABILITIESCVE-2026-49135

HIGH

CVE-2026-49135

CWE-59Published: June 1, 2026· Updated: Jun 2, 2026

7.1

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:6.6th

Official Description

CodexBar prior to 0.32.0 contains an insecure temporary file handling vulnerability that allows local attackers to access sensitive credentials or tamper with build artifacts by exploiting predictable file paths in the release notarization workflow. Attackers with access to the same host can read the App Store Connect API key written to a fixed path, pre-create files or symbolic links at predictable locations to redirect writes to attacker-controlled destinations, or tamper with notarization archives before submission.

NVD Source

Technical Analysis

CVE-2026-49135 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 7.1.