CVE-2026-47122 Overview
CVE-2026-47122 affects Sparkle, a widely used software update framework for macOS applications. The vulnerability resides in Autoupdate/AppInstaller.m and stems from missing authentication on the registered Mach service <bundleId>-spki. The framework only enforces SUCodeSigningVerifier validateConnection: in shouldAcceptNewConnection: before stage 1 of the installation completes. After _performedStage1Installation = YES is set, new local connections are accepted without team-ID or code-signing checks. This weakness is classified under [CWE-306] (Missing Authentication for Critical Function). Sparkle versions up to and including 2.9.1 are affected, and no patched release is available at time of publication.
Critical Impact
Any local process can connect to the Sparkle installer Mach service after stage 1 completes, bypassing code-signing and team-ID validation to interact with the privileged update flow.
Affected Products
- Sparkle software update framework versions up to and including 2.9.1
- macOS applications embedding vulnerable Sparkle versions
- Third-party applications relying on Sparkle's AppInstaller XPC-style Mach service
Discovery Timeline
- 2026-07-21 - CVE-2026-47122 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-47122
Vulnerability Analysis
Sparkle's AppInstaller component registers a Mach service named <bundleId>-spki to coordinate installation stages between the main application and the auto-update helper. The shouldAcceptNewConnection: handler validates the peer using SUCodeSigningVerifier validateConnection:, ensuring only code-signed clients matching the expected team identifier can connect. This check is only performed while _performedStage1Installation is NO. Once stage 1 finishes and the flag flips to YES, the handler returns success for any incoming connection. Any unprivileged local process on the same machine can then open a new connection to the service and issue installer messages. The vulnerability is a classic authentication state machine flaw where a critical check is scoped to a single phase rather than enforced for every connection.
Root Cause
The root cause is a conditional branch in shouldAcceptNewConnection: that treats stage 1 completion as a signal to relax authentication. The intended design assumes only trusted callers exist after stage 1, but the Mach service remains reachable to any local UID. No compensating control validates the peer's audit token, team ID, or signing identity after the flag is set.
Attack Vector
Exploitation requires local code execution and awareness of the target bundle identifier. An attacker races or waits until the legitimate updater completes stage 1, then opens a new connection to <bundleId>-spki. Because peer validation is skipped, the attacker's process is accepted and can send messages that influence the remaining installer stages. Attack complexity is elevated by the timing requirement and the need to already run code on the host.
No verified proof-of-concept code is publicly available. Technical specifics are described in the GitHub Security Advisory.
Detection Methods for CVE-2026-47122
Indicators of Compromise
- Unexpected local processes opening connections to Mach services with the -spki suffix that do not match the parent application's signing identity.
- Sparkle Autoupdate or AppInstaller child processes spawned outside the normal update cadence of the host application.
- Modifications to application bundles in /Applications or ~/Applications immediately following Sparkle update activity.
Detection Strategies
- Monitor bootstrap_check_in and Mach port lookups referencing bundle-scoped service names ending in -spki.
- Correlate AppInstaller executions with the code signature and team ID of the initiating process to spot unsigned or ad-hoc signed peers.
- Alert on privileged file writes performed by Sparkle helpers when the triggering client process is not the expected host application.
Monitoring Recommendations
- Enable macOS Endpoint Security Framework telemetry for ES_EVENT_TYPE_NOTIFY_EXEC and IPC-related events on endpoints running Sparkle-enabled apps.
- Baseline expected update behavior per application and flag deviations in installer child process lineage.
- Retain unified logs covering com.apple.xpc and com.apple.launchd subsystems for post-incident review.
How to Mitigate CVE-2026-47122
Immediate Actions Required
- Inventory macOS applications that bundle Sparkle and identify versions at or below 2.9.1 using otool -L or bundle inspection of Sparkle.framework/Resources/Info.plist.
- Restrict local account privileges and limit installation of untrusted software to reduce the pool of processes that can abuse the Mach service.
- Track the Sparkle GitHub Security Advisory for a patched release and prioritize upgrade once available.
Patch Information
As of the NVD publication date, no patched version of Sparkle is available. Application vendors embedding Sparkle should monitor the upstream project and re-release their applications with the fixed framework version when published. Refer to the GitHub Security Advisory GHSA-g3hp-f6mg-559v for the authoritative status.
Workarounds
- Avoid running Sparkle-enabled applications on multi-user macOS hosts where untrusted local users may be present.
- Where feasible, disable Sparkle's automatic update check and manage updates through a managed software distribution channel until a patch is released.
- Application developers can implement additional peer validation on their own XPC listeners and consider disabling the installer service between update sessions.
# Identify Sparkle version embedded in an installed application bundle
/usr/libexec/PlistBuddy -c "Print :CFBundleShortVersionString" \
"/Applications/ExampleApp.app/Contents/Frameworks/Sparkle.framework/Resources/Info.plist"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
