CVE-2026-49135 describes an insecure temporary file handling vulnerability in steipete CodexBar before version 0.32.0. The issue arises from the use of predictable file paths in the release notarization workflow, enabling local attackers to read sensitive credentials or manipulate build artifacts. Specifically, the App Store Connect API key is written to a fixed path, which can be read by attackers or used to redirect file writes via pre-created files or symbolic links. This can lead to tampering with notarization archives prior to submission. The vulnerability requires local access with low privileges and does not involve user interaction.

Local attackers with access to the host can read sensitive credentials such as the App Store Connect API key, potentially compromising the security of the notarization process. They can also tamper with build artifacts by redirecting file writes or modifying notarization archives, which may lead to unauthorized code being submitted or trusted processes being subverted. This undermines the integrity and confidentiality of the build and release workflow.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid running CodexBar in multi-user environments where untrusted users have local access. Restrict file system permissions to prevent unauthorized creation or modification of files in predictable temporary file locations used by CodexBar.