# Apple macOS Tahoe and Xcode Local Information Disclosure Vulnerabilities - CVE-2026-112602, CVE-2026-112605

> Apple fixed two local information-disclosure flaws affecting Xcode prior to 27.2 and macOS Tahoe prior to 26.6: an Instruments authorization issue (CVE-2026-112602) and a CoreDevice symlink-handling issue (CVE-2026-112605). Each is rated CVSS 3.3 (LOW) by NVD, and no exploitation is reported.

- **Published:** 2026-11-06T23:14:51Z
- **Last reviewed:** 2026-11-06T23:14:51Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5454
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5454.png
- **ID:** TL-2026-5454
- **Severity:** LOW (CVSS 3.3)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 11
- **CVEs:** CVE-2026-112602, CVE-2026-112605

## Description

Apple's security content for Xcode 27.2 (released 2026-10-29, availability: macOS Tahoe 26.6 and later) lists two issues. CVE-2026-112602 is in the Instruments component: an authorization issue (CWE-285) that allowed an app to access sensitive user data, fixed with improved state management in authorization processes. Reporter: Roelof van Dijk.

CVE-2026-112605 is in the CoreDevice component: improper symlink handling (CWE-59, improper link resolution before file access) that allowed an app to read arbitrary files, fixed with improved handling of symlinks. Reporter: Vladislav Shevchenko (Positive Technologies).

NVD published both records on 2026-10-30 (last modified 2026-11-04) and scores both CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N (3.3 LOW): local access, user interaction, limited confidentiality impact only. The NVD CPE configuration for both is apple:xcode versions below 27.2. For CVE-2026-112602 the NVD record carries an SSVC assessment of no evidence of exploitation and partial technical impact; the CVE-2026-112605 record was still marked Awaiting Analysis when reviewed. GovCERT.HK alert A26-10-66 (2026-10-30) states that, depending on the vulnerabilities exploited, an attack could lead to remote code execution or information disclosure. The vendor and NVD descriptions support information disclosure only, so this record follows the vendor.

No active exploitation, public PoC, threat actor attribution, or network/file IOCs are stated in any source. The CISA KEV catalog (version 2026.11.06) was checked; neither CVE appeared in the portion of the catalog that could be read, so a KEV listing is not confirmed. The MITRE ATT&CK mappings on this record are potential-impact mappings derived from the vendor-described capability (a locally run app reading data it should not be able to reach) and are not evidence of in-the-wild use. The IOC entries list the affected components, products and credited parties for asset-inventory and patch-hunting purposes, not attacker infrastructure. Remediation is to update to macOS Tahoe 26.6 and Xcode 27.2.

## MITRE ATT&CK

- T1204.002 User Execution: Malicious File
- T1548 Abuse Elevation Control Mechanism
- T1552.001 Unsecured Credentials: Credentials In Files
- T1005 Data from Local System

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Symlink Toward Credential, Keychain or User-Data Store — CoreDevice CVE-2026-112605 Exploitation Precursor** (`TL-2026-5454-SPL-001`)

Detects creation of symbolic links that point at SSH keys, GPG keys, cloud credentials, keychains or Messages/Mail data. Symlink-following arbitrary file read (CWE-59) is the vulnerability class of CVE-2026-112605 in CoreDevice (fixed in macOS Tahoe 26.6 / Xcode 27.2). A local app must first stage such a link, so this fires on the behaviour rather than on a specific exploit. Maps to local data collection (T1005), credentials in files (T1552.001), private keys (T1552.004) and keychain access (T1555.001). No exploitation is reported; this is a potential-impact detection.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1005, T1552.001, T1552.004, T1555.001
- **Data sources:** macos_endpoint_security, osquery_es_process_events, defender_for_endpoint_macos
- **Severity:** medium
- **Confidence:** medium

### Splunk SPL

````spl
index=macos sourcetype="osquery:results" name="es_process_events" earliest=-24h
  columns.path="/bin/ln" columns.cmdline="* -s*"
| search columns.cmdline IN ("*/.ssh/*", "*/.aws/credentials*", "*/.kube/config*", "*/.config/gcloud*", "*/Library/Keychains*", "*/.docker/config.json*", "*/.netrc*", "*/.gnupg/*", "*/Library/Messages*", "*/Library/Mail*")
```Symlink to credential or user-data store; CVE-2026-112605 CWE-59 symlink-following pattern```
| eval proc_user='columns.username', symlink_cmd='columns.cmdline'
| stats count min(_time) as first_seen max(_time) as last_seen values(symlink_cmd) as symlink_commands by host, proc_user
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
let sensitive = dynamic(["/.ssh/", "/.aws/credentials", "/.kube/config", "/.config/gcloud", "/Library/Keychains", "/.docker/config.json", "/.netrc", "/.gnupg/", "/Library/Messages", "/Library/Mail"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FolderPath startswith "/"
| where FileName =~ "ln" and ProcessCommandLine has " -s"
| where ProcessCommandLine has_any (sensitive)
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessSHA256
```

### Sigma

```yaml
title: macOS Symlink Created Toward Credential or User-Data Store
id: 5b0f2c1e-6a41-4d38-9c52-7e1a3d8f4b01
status: experimental
description: Detects ln -s targeting SSH keys, GPG keys, cloud credentials, keychains or Messages/Mail data, the setup step for symlink-following arbitrary file read such as CVE-2026-112605 (CoreDevice, CWE-59). Potential-impact rule; no exploitation is reported.
references:
    - https://support.apple.com/en-us/149589
    - https://nvd.nist.gov/vuln/detail/CVE-2026-112605
    - https://attack.mitre.org/techniques/T1552/001/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
    - attack.collection
    - attack.t1005
    - attack.credential_access
    - attack.t1552.001
    - attack.t1552.004
    - attack.t1555.001
    - cve.2026.112605
logsource:
    category: process_creation
    product: macos
detection:
    sel_img:
        Image|endswith:
            - '/ln'
    sel_flag:
        CommandLine|contains:
            - ' -s'
    sel_path:
        CommandLine|contains:
            - '/.ssh/'
            - '/.aws/credentials'
            - '/.kube/config'
            - '/.config/gcloud'
            - '/Library/Keychains'
            - '/.docker/config.json'
            - '/.netrc'
            - '/.gnupg/'
            - '/Library/Messages'
            - '/Library/Mail'
    condition: sel_img and sel_flag and sel_path
falsepositives:
    - Administrators relocating dotfiles or SSH config into a managed directory
    - Dotfile managers and backup tools linking config files
level: medium

```

**Known false positives:**

- Dotfile managers (stow, chezmoi) linking ~/.ssh or ~/.aws config
- Admins relocating credential directories with ln -s

**Tuning notes:** Adjust index, sourcetype and the name filter to your osquery or Endpoint Security telemetry. Exclude known dotfile-management accounts or parent tools. Extend the path list with in-house secret stores. Prioritise hosts still on Xcode < 27.2 or macOS Tahoe < 26.6.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- User-Run App Bundle from Untrusted Location Spawning Shell or File-Access Tools — CVE-2026-112602 / CVE-2026-112605 Precondition (locked: unlock with TL Creds)
- CoreDevice devicectl/coredeviced Referencing Sensitive Paths — CVE-2026-112605 (locked: unlock with TL Creds)
- Bulk Copy or Archive of Messages/Mail/Safari/Cookie Data — Sensitive User Data Collection (locked: unlock with TL Creds)
- Direct Read or Copy of Credential, Key and Keychain Files on macOS (locked: unlock with TL Creds)
- macOS Authorization State Tampering — authorizationdb write, DevToolsSecurity, Developer/Admin Group Edits (locked: unlock with TL Creds)
- Gatekeeper Bypass — Quarantine Attribute Removal via xattr or spctl Assessment Changes (locked: unlock with TL Creds)
- Instruments / xctrace Profiling Other Processes — CVE-2026-112602 Authorization Abuse Surface (locked: unlock with TL Creds)
- Credential and Private-Key Hunting via find/grep/mdfind — Post-Read Discovery (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [GovCERT.HK Security Alert A26-10-66: Multiple Vulnerabilities in Apple Products](https://www.govcert.gov.hk/en/alerts_detail.php?id=2155)
- [Apple Security Content: Xcode 27.2](https://support.apple.com/en-us/149589)
- [NVD CVE-2026-112602](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-112602)
- [NVD CVE-2026-112605](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-112605)
- [CVE-2026-112602 (MITRE)](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112602)
- [CVE-2026-112605 (MITRE)](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-112605)
- [CISA Known Exploited Vulnerabilities Catalog (checked 2026-11-06)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5454