Read the docs
TI-2026-26513 Aliases CVE-2026-34218

ClearanceKit: Managed and user-defined policy rules not enforced between opfilter start and first policy modification

Priority LOW 27CWE-269Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Privilege escalation
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 4.2.14, two related startup defects created a window during which only the single compile-time baseline rule was enforced by opfilter. All managed (MDM-delivered) and user-defined file-access rules were not applied until the user interacted with policies through the GUI, triggering a policy mutation over XPC. This issue has been patched in version 4.2.14.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00203 10th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed clearancekit (craigjbass): 4.2.14

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
craigjbassclearancekitbefore 4.2.144.2.14Patch availableCNA
  • clearancekit Vendorcraigjbass Affected before 4.2.14 Fixed in 4.2.14 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:craigjbass:clearancekit:*:*:*:*:*:*:*:*before 4.2.14Vulnerablecraigjbass
  • cpe:2.3:a:craigjbass:clearancekit:*:*:*:*:*:*:*:* Versions before 4.2.14 Vulnerable ·craigjbass

Remediation

  • Fix · CNA clearancekit (craigjbass) Fixed in 4.2.14

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34218

References

Exploit 1

Patch 2

  • TI-2026-29335 ClearanceKit: Ad-hoc signed binaries can spoof Apple process identities in the global allowlist CVSS 4.0HIGH 8.4
  • TI-2026-26012 ClearanceKit: opfilter policy bypass via non-open file operations CVSS 3.1HIGH 8.7
  • TI-2026-26013 ClearanceKit: opfilter policy bypass via exchangedata and clone operations CVSS 4.0HIGH 8.4
  • TI-2026-29340 Protection mechanism failure in craigjbass clearancekit CVSS 4.0HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences