CVE-2026-47122: Sparkle missing authentication in AppInstaller Mach service connection

CVE-2026-47122 · Severity: medium · CVSS 4.2 · Published 2026-07-21

Sparkle is a widely used software update framework for macOS applications. A security flaw in the update process allows a malicious local program to bypass security checks and inject fake update information during a specific stage of the installation. While this does not allow the attacker to install malicious code, it enables them to display fraudulent release notes, version numbers, and 'critical update' flags to the user, potentially leading to social engineering or misinformation.

Vendors: Swift.

Quick answers

Is CVE-2026-47122 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47122 being exploited in the wild.
How severe is CVE-2026-47122?
Medium severity, with a CVSS score of 4.2, published 21 July 2026.
Which products and versions are affected?
Sparkle Project Sparkle <= 2.9.1, 2.x branch including 2.9.1; github.com/sparkle-project/Sparkle (Swift) <= 2.9.1.
Is there a fix for CVE-2026-47122?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-47122 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-47122?
Check whether you run Sparkle Project Sparkle or github.com/sparkle-project/Sparkle (Swift) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authentication vulnerability exists in Sparkle's `Autoupdate/AppInstaller.m` within the `shouldAcceptNewConnection:` method. The framework only enforces `SUCodeSigningVerifier` validation before the `_performedStage1Installation` flag is set to true. Once stage 1 completes, the registered Mach service (`<bundleId>-spki`) accepts connections from any local process without verifying Team ID or code signatures. An attacker can exploit a tight timing window—specifically if the legitimate updating app crashes or exits before sending final data—to inject a spoofed `SPUSentUpdateAppcastItemData` payload. This results in the Sparkle progress agent broadcasting attacker-controlled metadata (name, version, release notes) to other Sparkle-aware applications on the system. No patch was available at the time of publication.

Affected products

  • sparkle-project Sparkle <= 2.9.1

Identifiers

  • CVE-2026-47122
  • GHSA-g3hp-f6mg-559v

Timeline

  • 2026-05-19: advisory: GitHub Security Advisory published
  • 2026-07-21: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.