CVE-2026-33874: Gematik Authenticator RCE Vulnerability

CVE-2026-33874 Overview

CVE-2026-33874 is a Command Injection vulnerability affecting the Gematik Authenticator application on macOS. The Gematik Authenticator is designed to securely authenticate users for login to digital health applications in Germany's healthcare infrastructure. Starting in version 4.12.0 and prior to version 4.16.0, the macOS version of the Authenticator is vulnerable to remote code execution when victims open a malicious file. This vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Critical Impact

Successful exploitation allows attackers to execute arbitrary commands on the victim's system with the same privileges as the Authenticator application, potentially compromising sensitive healthcare authentication data and patient information.

Affected Products

• Gematik Authenticator versions 4.12.0 to 4.15.x on macOS
• Apple macOS (all supported versions running vulnerable Authenticator)
• Healthcare authentication workflows dependent on Gematik Authenticator

Discovery Timeline

• 2026-03-27 - CVE-2026-33874 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-33874

Vulnerability Analysis

This vulnerability is a classic command injection flaw (CWE-78) in the Gematik Authenticator's file handling mechanism on macOS. The application fails to properly sanitize or validate user-supplied input when processing certain file types, allowing an attacker to inject operating system commands that are subsequently executed by the application.

The attack requires local access and user interaction—specifically, the victim must open a specially crafted malicious file. Once opened, the injected commands execute with the full privileges of the Authenticator process, which may include access to sensitive healthcare credentials and authentication tokens.

The impact is significant given the Authenticator's role in Germany's digital health infrastructure, where compromise could lead to unauthorized access to patient health records and healthcare provider systems.

Root Cause

The root cause is improper neutralization of special elements used in OS commands (CWE-78). The macOS version of the Gematik Authenticator does not adequately sanitize input from files before passing data to system command execution functions. This allows attackers to craft files containing shell metacharacters or command sequences that break out of the intended context and execute arbitrary commands.

Attack Vector

The attack vector requires local file access and user interaction. An attacker must craft a malicious file and convince the victim to open it using the Gematik Authenticator. This could be achieved through phishing emails, malicious downloads, or supply chain attacks targeting healthcare workers who regularly use the Authenticator.

The exploitation flow involves:

1. Attacker creates a specially crafted file containing embedded OS commands
2. Victim receives the file through social engineering or other delivery mechanisms
3. Victim opens the malicious file with the Gematik Authenticator
4. Unsanitized input is passed to a command execution function
5. Injected commands execute with Authenticator privileges

The vulnerability manifests in the file processing mechanism of the macOS Authenticator. For detailed technical information, refer to the GitHub Security Advisory GHSA-mjgm-7hwc-qqcr.

Detection Methods for CVE-2026-33874

Indicators of Compromise

• Unexpected child processes spawned by the Gematik Authenticator application
• Unusual network connections originating from the Authenticator process
• Suspicious file access patterns or modifications to system files after Authenticator usage
• Abnormal command-line arguments in process execution logs related to the Authenticator

Detection Strategies

• Monitor process creation events for the Gematik Authenticator spawning unexpected shell processes (/bin/sh, /bin/bash, /bin/zsh)
• Implement endpoint detection rules for command injection patterns in file-based application invocations
• Review application logs for malformed input or error messages indicating injection attempts
• Deploy SentinelOne behavioral AI to detect anomalous process behaviors from trusted healthcare applications

Monitoring Recommendations

• Enable detailed process auditing on macOS endpoints running Gematik Authenticator
• Configure SIEM alerts for Authenticator processes executing shell commands or accessing sensitive system resources
• Implement file integrity monitoring on Authenticator installation directories
• Monitor for suspicious file downloads targeting healthcare workers

How to Mitigate CVE-2026-33874

Immediate Actions Required

• Update the Gematik Authenticator to version 4.16.0 or later immediately
• Alert healthcare staff about the risks of opening untrusted files with the Authenticator
• Review recent file activity on systems running vulnerable versions for signs of exploitation
• Consider temporarily restricting Authenticator file associations until patching is complete

Patch Information

Gematik has released version 4.16.0 of the Authenticator which addresses this vulnerability. The patch implements proper input sanitization for file processing on macOS, preventing command injection attacks.

Organizations should:

1. Download the patched version from official Gematik distribution channels
2. Verify the integrity of the update package before installation
3. Deploy updates across all affected macOS endpoints
4. Validate successful patching through version verification

For additional details, see the Gematik Security Advisory.

Workarounds

• No official workarounds are available according to the vendor advisory
• As a defense-in-depth measure, restrict which file types can be opened by the Authenticator at the OS level
• Implement strict email filtering to block potentially malicious file attachments
• Limit Authenticator usage to trusted, verified files from known sources until patching is complete

# Verify Gematik Authenticator version on macOS
# Ensure version is 4.16.0 or higher
mdls -name kMDItemVersion /Applications/gematik\ Authenticator.app