AI Threat AlertCVE-2026-49450: Joplin Desktop: update signature check skipped on Windows
HIGHCISA: ATTENDJoplin Desktop for Windows before 3.7.2 ships without a publisherName in its build config, so the auto-updater never compares the Authenticode signer of a downloaded update against Joplin's own. An attacker who can tamper with the update path, for example on a shared Wi-Fi or a compromised proxy, could serve a rogue installer that is unsigned or signed by another publisher, and the client will accept it once the user approves the install. The result is code execution with the user's privileges, exposing notes, stored credentials and local data. Real-world risk is moderate: it requires an adjacent-network position, high attack complexity and user interaction, and there is no public exploit, no Nuclei template and no CISA KEV listing. EPSS is low in absolute terms (0.18%) though in the 93rd percentile, and CISA SSVC rates it ATTEND. Upgrade Joplin Desktop on Windows to 3.7.2 or later, and prioritize endpoints used by staff on untrusted networks. Note that Joplin is a general note-taking app and is not an AI/ML framework, so AI-specific exposure is limited to AI-adjacent notes and credentials stored on affected workstations.
What is the risk?
CVSS 7.1 (High). Exploitation needs an adjacent-network attacker able to intercept or replace update metadata and the installer, high complexity, and a user who approves the install. No public exploit, no Nuclei template and no KEV listing. EPSS is 0.00182, in the 93rd percentile. SSVC is ATTEND. Overall risk is medium for most organizations and higher for users on untrusted networks. Impact is high for confidentiality, integrity and availability, because the attacker's code runs as the user. The product is not an AI/ML component, so AI-specific risk is indirect.
How does the attack unfold?
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade Joplin Desktop on Windows to 3.7.2 or later, installing from the official source rather than through the in-app updater until patched. 2) Inventory Joplin installs across Windows endpoints with your software management tooling. 3) Avoid applying updates on untrusted or shared networks. 4) Rotate any credentials or API keys stored in notes if a rogue update is suspected. 5) Detection: monitor for installers executed from the Joplin updater cache directory that lack a valid Authenticode signature or are signed by a publisher other than Joplin, and alert on unusual child processes spawned by the Joplin updater. 6) Block or inspect outbound update traffic through TLS-intercepting or allow-listed proxies where feasible.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-49450?
Joplin Desktop for Windows before 3.7.2 ships without a publisherName in its build config, so the auto-updater never compares the Authenticode signer of a downloaded update against Joplin's own. An attacker who can tamper with the update path, for example on a shared Wi-Fi or a compromised proxy, could serve a rogue installer that is unsigned or signed by another publisher, and the client will accept it once the user approves the install. The result is code execution with the user's privileges, exposing notes, stored credentials and local data. Real-world risk is moderate: it requires an adjacent-network position, high attack complexity and user interaction, and there is no public exploit, no Nuclei template and no CISA KEV listing. EPSS is low in absolute terms (0.18%) though in the 93rd percentile, and CISA SSVC rates it ATTEND. Upgrade Joplin Desktop on Windows to 3.7.2 or later, and prioritize endpoints used by staff on untrusted networks. Note that Joplin is a general note-taking app and is not an AI/ML framework, so AI-specific exposure is limited to AI-adjacent notes and credentials stored on affected workstations.
Is CVE-2026-49450 actively exploited?
No confirmed active exploitation of CVE-2026-49450 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-49450?
1) Upgrade Joplin Desktop on Windows to 3.7.2 or later, installing from the official source rather than through the in-app updater until patched. 2) Inventory Joplin installs across Windows endpoints with your software management tooling. 3) Avoid applying updates on untrusted or shared networks. 4) Rotate any credentials or API keys stored in notes if a rogue update is suspected. 5) Detection: monitor for installers executed from the Joplin updater cache directory that lack a valid Authenticode signature or are signed by a publisher other than Joplin, and alert on unusual child processes spawned by the Joplin updater. 6) Block or inspect outbound update traffic through TLS-intercepting or allow-listed proxies where feasible.
What systems are affected by CVE-2026-49450?
This vulnerability affects the following AI/ML architecture patterns: Developer workstations, Desktop applications with auto-update.
What is the CVSS score for CVE-2026-49450?
CVE-2026-49450 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.18%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0010.001AI SoftwareAML.T0011User ExecutionCompliance Controls Affected
What are the technical details?
Original Advisory
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Desktop for Windows omits publisherName from packages/app-desktop/package.json, so the generated app-update.yml causes NsisUpdater.verifySignature() to skip comparison of a downloaded update's Authenticode signer with Joplin's signer. An attacker who controls the update delivery path can replace the update metadata and installer, and the client accepts an installer signed by another publisher or left unsigned after the user approves installation. Successful exploitation runs attacker-controlled code with the user's privileges and can compromise notes, credentials, and local data. This issue is fixed in version 3.7.2.
Exploitation Scenario
An attacker on the same network as a target, such as a conference or hotel Wi-Fi, positions themselves to intercept the Joplin update check, then substitutes the update metadata and an installer they control. The Joplin client does not compare the installer's signer to Joplin's, so it accepts the rogue file, either unsigned or signed by the attacker's own certificate. When the user approves the update, the installer runs with their privileges. The attacker then harvests notes containing API keys and model-provider credentials, steals sync tokens, and uses the workstation as a foothold into AI development and cloud environments.
Weaknesses (CWE)
CWE-345Insufficient Verification of Data AuthenticityPrimaryCWE-353Missing Support for Integrity CheckPrimaryCWE-494Download of Code Without Integrity CheckPrimaryCWE-345Insufficient Verification of Data AuthenticityCWE-353Missing Support for Integrity CheckCWE-494Download of Code Without Integrity CheckCWE-345 — Insufficient Verification of Data Authenticity: The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HReferences
Timeline
Related Vulnerabilities
CVE-2025-5952810.0Flowise: Unauthenticated RCE via MCP config injection
Same attack type: Supply ChainCVE-2024-291210.0BentoML: RCE via insecure deserialization (CVSS 10)
Same attack type: Supply ChainCVE-2023-376510.0MLflow: path traversal allows arbitrary file read
Same attack type: Supply ChainCVE-2025-512010.0smolagents: sandbox escape enables unauthenticated RCE
Same attack type: Supply ChainCVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same attack type: Code Execution