A signed-in domain user can have the credential that unlocks an entire corporate network lifted out of memory on a managed Mac, and the vendor calls the behaviour correct.
Researchers at NR Labs documented a path using kcc, a command line utility shipped inside macOS, to copy a Kerberos Ticket Granting Ticket out of the credential cache Apple now guards with a background daemon. Their write-up landed October 23; the work was captured in December 2025 and re-confirmed on macOS Tahoe 26.6.2 in September 2026.
Why the ticket matters more than the password
A TGT is the token a Key Distribution Center hands out after a successful login. Every later request for a file share, printer, or mail server rides on it, which is why single sign-on works without repeated prompts.
Apple moved these tokens off disk and into memory under the Kerberos Credential Manager, whose cache System Integrity Protection defends. A custom exporter written to read that cache gets refused, because only Apple-signed binaries pass.
The utility already carries that signature, and it exposes an undocumented copy function. One instruction moves a live ticket into a plain file:
kcc copy API:<cache-id> FILE:/tmp/lab-krb5.cc
The team converted the blob with an open source tool named Bifrost, carried it to a Windows host, and authenticated as the victim through Rubeus. No cracked password, no exploit chain.
Apple sees a boundary that was never crossed
NR Labs reported the behaviour on September 14. Apple answered a week later that reading your own tickets is intended functionality. No CVE identifier was assigned and nothing was patched.
The researchers reject that framing: if a cache exists to stop extraction, an export path defeats its purpose.
Defenders are left with detection work. Watch for kcc writing credential caches to file paths after odd shell activity.
