CVE-2026-33874: 
NixOS vulnerability analysis and mitigation

CVE-2026-33874 is a remote code execution (RCE) vulnerability in the macOS version of Gematik Authenticator, an application used for secure authentication to digital health applications. The flaw affects versions 4.12.0 through 4.15.x and was published on March 27, 2026, with a patch available in version 4.16.0. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Red Hat CVE).

The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command / OS Command Injection). Attackers can craft a malicious macOS keychain database file (.keychain-db) containing a payload designed to execute arbitrary OS commands. When a victim opens this file, macOS installs the keychain (typically prompting only for the user password, not administrative credentials), and the payload executes each time the Gematik Authenticator is subsequently launched — persisting until the malicious keychain is manually removed. The attack vector is local with required user interaction, meaning the victim must be socially engineered into opening the crafted file (GitHub Advisory).

Successful exploitation results in arbitrary code execution on the victim's macOS system with the privileges of the user running the Authenticator, leading to high confidentiality, integrity, and availability impact. An attacker could gain persistent access to the compromised system, potentially accessing sensitive personal health information and digital health applications authenticated through the Gematik Authenticator. The payload persists across Authenticator restarts until the malicious keychain database is manually removed, extending the window of compromise (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.069%, indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — specifically, the victim must open a maliciously crafted .keychain-db file — which limits opportunistic exploitation but makes it suitable for targeted social engineering attacks against healthcare sector users.

1. Craft malicious keychain database: Create a .keychain-db file containing an embedded OS command injection payload designed to execute arbitrary code when the Gematik Authenticator reads or processes the keychain on startup.
2. Deliver the malicious file: Distribute the crafted .keychain-db file to the target via phishing email, malicious download link, or other social engineering techniques targeting healthcare professionals using Gematik Authenticator on macOS.
3. Victim opens the file: The victim opens the .keychain-db file; macOS prompts for the user's password (standard user credentials, not admin) and installs the keychain into the system keychain list.
4. Payload triggers on Authenticator launch: Each time the victim starts the Gematik Authenticator (versions 4.12.0–4.15.x), the application processes the installed keychain, triggering the injected OS command payload and executing arbitrary code with the user's privileges.
5. Persistence: The payload continues to execute on every Authenticator startup until the malicious keychain database is manually identified and removed from the macOS keychain list (GitHub Advisory).

• File System: Presence of unexpected or unrecognized .keychain-db files in macOS keychain directories (e.g., ~/Library/Keychains/); newly added keychain entries not associated with legitimate applications.
• Process: Unusual child processes spawned by the Gematik Authenticator process at startup (e.g., shell interpreters like /bin/bash, /bin/sh, curl, python, or network utilities); unexpected processes running under the user account after Authenticator launch.
• Logs: macOS system logs (/var/log/system.log or unified logging via log show) showing keychain access events or unexpected process spawning correlated with Authenticator startup; macOS Security audit logs recording keychain installation events from unknown sources.
• Network: Unexpected outbound network connections originating from the Gematik Authenticator process or its child processes to unknown external IP addresses or domains (GitHub Advisory).

The only available remediation is to update the Gematik Authenticator to version 4.16.0 or later; there are no known workarounds or configuration-based mitigations. The updated version can be obtained from the GitHub releases page (https://github.com/gematik/app-Authenticator/releases) or via the app store, and the application may update itself automatically depending on configuration. Organizations should also train users to avoid opening .keychain-db files from untrusted sources and consider implementing application whitelisting to restrict unauthorized file execution (GitHub Advisory).

The vulnerability was responsibly disclosed by Dr. Simon Weber and Volker Schönefeld from Machine Spirits UG via the gematik Coordinated Vulnerability Disclosure Program (CVDP), and gematik credited them in the official advisory (GitHub Advisory). The vulnerability was tracked by ENISA under EUVD-2026-16816 and noted by Red Hat's CVE database, reflecting standard cross-industry monitoring of the disclosure. No significant broader media coverage or notable social media commentary beyond routine CVE tracking aggregators has been identified.