CVE-2026-47122

Sparkle is a software update framework for macOS. In versions up to and including 2.9.1, `Autoupdate/AppInstaller.m`'s `shouldAcceptNewConnection:` only enforces `SUCodeSigningVerifier validateConnection:` before stage 1 completes. After `_performedStage1Installation = YES`, new connections to the registered Mach service `<bundleId>-spki` are accepted from any local process without team-ID or code-signing checks. As of time of publication, no known patched versions are available.

• CWE-306
• CWE-441

• https://github.com/sparkle-project/Sparkle/security/advisories/GHSA-g3hp-f6mg-559vVendor Advisory, Mitigation

Published

Jul 21, 2026

Last Modified

Aug 5, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47117OpenMed before 1.5.2 contains a remote code execution vulner…9.8
• CVE-2026-47118Agent Zero before version 1.15 contains a path traversal vul…7.1
• CVE-2026-47119Agent Zero before version 1.15 contains a stored cross-site …6.1
• CVE-2026-4712Information disclosure in the Widget: Cocoa component. This …7.5
• CVE-2026-47120Nezha Monitoring is a self-hostable, lightweight, servers an…7.1
• CVE-2026-47121Sparkle is a software update framework for macOS. Prior to v…6.1
• CVE-2026-47123FreeScout is a free help desk and shared inbox built with PH…7.5
• CVE-2026-47124Nezha Monitoring is a self-hostable, lightweight, servers an…6.5
• CVE-2026-47125Arcane is an interface for managing Docker containers, image…8.8
• CVE-2026-47127Ghostfolio is an open source wealth management software. Pri…6.5
• CVE-2026-47128nono is software that allows users to run AI agents in a zer…6.1
• CVE-2026-47129NextCRM is open-source customer relationship management (CRM…8.1