CVE-2026-47122 | Sparkle is a software update framework for macOS. In version… | CVSS 4.2 MEDIUM

Description

Sparkle is a software update framework for macOS. In versions up to and including 2.9.1, `Autoupdate/AppInstaller.m`'s `shouldAcceptNewConnection:` only enforces `SUCodeSigningVerifier validateConnection:` before stage 1 completes. After `_performedStage1Installation = YES`, new connections to the registered Mach service `<bundleId>-spki` are accepted from any local process without team-ID or code-signing checks. As of time of publication, no known patched versions are available.

Metadata

CVE ID: CVE-2026-47122
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-05-18 19:50 UTC
Published: 2026-07-21 13:57 UTC
Last updated: 2026-07-21 14:55 UTC
Primary CWE: CWE-306
CWE-306: Missing Authentication for Critical Function
Vendor / Product: sparkle-project / Sparkle
Sources: cve.org · NVD

Severity & Metrics

4.2 MEDIUM CVSS 3.1

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
sparkle-project	Sparkle	—	<= 2.9.1

Weakness (CWE)

CWE	Source	Description
CWE-306	cna	CWE-306: Missing Authentication for Critical Function
CWE-441	cna	CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')

CVSS scores (1)

Score	Severity	Version	Source	Vector
4.2	MEDIUM	3.1	cna	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L

References (1)

https://github.com/sparkle-project/Sparkle/security/advisories/GHSA-g3hp-f6mg-559v https://github.com/sparkle-project/Sparkle/security/advisories/GHSA-g3hp-f6mg-559v