CVE-2026-40191
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
ClearanceKit versions prior to 5.0.4-beta-1f46165 have a flaw in the Endpoint Security event handler where only the source path of dual-path file operations is checked, and the destination path is ignored. This allows any local process to bypass file-access protection using rename, link, copyfile, exchangedata, or clone operations.
Risk Assessment
A local attacker could place or replace files inside protected directories, bypassing security policies. This may lead to confidentiality and integrity breaches.
Recommendation
Update ClearanceKit to version 5.0.4-beta-1f46165 or later. Until patched, restrict the ability of untrusted processes to perform rename/link/copyfile operations.
Other vulnerabilities in ClearanceKit
See all- CVE-2026-47134Medium
In ClearanceKit before version 5.0.10, the ECDSA key used to sign the policy database is stored in the macOS keychain without ACL restrictions. Any root process can use this key to sign arbitrary policy content.
- CVE-2026-47133Medium
In ClearanceKit before version 5.0.10, ECDSA signatures for SQLite database tables lack a version counter or freshness binding. An attacker can replace the database and signatures with an older, legitimately signed version, which will be accepted by the system.
- CVE-2026-40604Medium
In ClearanceKit before 5.0.6, the opfilter system extension can be suspended with SIGSTOP or killed with SIGKILL/SIGTERM by any process running as root. While suspended, AUTH Endpoint Security events time out and default to allow, silently disabling file-access policy enforcement.
- CVE-2026-34218Medium
ClearanceKit has a startup defect where only compile-time rules are enforced until user interacts with GUI. MDM and user-defined rules are not applied.
Original NVD description (English source)
ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.4-beta-1f46165, ClearanceKit's Endpoint Security event handler only checked the source path of dual-path file operations against File Access Authorization (FAA) rules and App Jail policies. The destination path was ignored entirely. This allowed any local process to bypass file-access protection by using rename, link, copyfile, exchangedata, or clone operations to place or replace files inside protected directories. This vulnerability is fixed in 5.0.4-beta-1f46165.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS