A logging issue in macOS Tahoe 26.0 allowed the disclosure of sensitive user data because log entries were not correctly redacted. The problem stems from inadequate input filtering and results in potential exposure of confidential information. The vulnerability aligns with CWE‑532, characterizing the improper handling of sensitive data in logs. An attacker could read logs containing personal data, violating privacy and confidentiality.

Apple’s macOS Tahoe 26.0 is affected. All installations of macOS Tahoe at version 26.0 that have not been updated to 26.1 or later are vulnerable. Later releases, beginning with 26.1, contain the log redaction fix.

The CVSS score of 5.5 indicates a moderate severity, and the EPSS score of < 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely local: a malicious or compromised application running under a user’s session could read the unauthenticated logs and retrieve sensitive information. The impact is limited to the confidentiality of user data and does not involve code execution or system compromise.