CVE-2026-20685: Sensitive Information Leakage in darwin-init

Vulnerability Overview CVE-2026-20685: In , an attacker may be able to leak sensitive information at privileged network locations. Scope of Impact Affected Component: Impact Description: An attacker can leak sensitive information at privileged network locations. Remediation Fix Measure: The path handling issue was resolved by improving validation. Fixed By: Drinor Selmanaj (Sentry) and Suresh Sundaram Additional Relevant Information PCC Release 5E290.3: - Visual Lookup: - Known Issue: The Visual Lookup feature is unavailable in the Virtual Research Environment (162320010). - PCC VRE: - New Feature: Shadow Tunneling facilitates the execution of Transitive Trust flows and the PCC Agent. PCC Release 5C235: - Request Handoff: - New Feature: PCC nodes can split request processing across two different collections using KV Cache Transfer. PCC Release 5A5264.1: - PCC VRE: - Known Issue: fails to restore the Trusted Proxy version and returns the error: "TIE Proxy VRE requires macOS Tahoe 26". - Workaround: Use macOS Tahoe 26 and add the parameter to (157755443). PCC Release 5A5214b.2: - Transitive Trust: - New Feature: PCC now uses PCC Proxy Nodes to establish encrypted communication between user devices and the PCC node executing the user's request, based on the concept of transitive trust. - PCC VRE: - Known Issue: PCC can route requests via transitive trust using the Trusted Proxy application. Trusted Proxy software is not supported in the VRE built with this release (148253942). - Known Issue: TIE accepts images as input to perform multi-modal inference. The VRE demo models do not currently support this feature (147590493). Summary Primary Vulnerability: CVE-2026-20685, involving path handling issues in that may lead to sensitive information leakage. Remediation: The path handling issue was resolved by improving validation. Other Issues: Known issues and new features exist in multiple PCC releases, but the primary focus remains on fixing CVE-2026-20685.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-20685: Sensitive Information Leakage in darwin-init