Read the docs
TI-2026-34725 Aliases CVE-2026-47134

Incorrect permission assignment in craigjbass clearancekit

Priority LOW 29CWE-732Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. The ECDSA private key used to sign the on-disk policy database (`/Library/Application Support/clearancekit/store.db`) is stored in the macOS System Keychain. The key was created via the two-step pattern `SecKeyCreateRandomKey` (in-memory) followed by `SecItemAdd(kSecValueRef:, kSecAttrAccess:)` (persist). Prior to version 5.0.10, for `kSecClassKey` items in the legacy System Keychain, `kSecAttrAccess` passed to `SecItemAdd` is silently ignored — the persisted key inherits no ACL restriction. The same access builder applied to `kSecClassGenericPassword` items correctly binds the ACL, making this bug specific to the EC key. The result is that any process running as root can use the key to produce valid signatures over arbitrary policy content. Version 5.0.10 fixes the issue. No known workarounds are available. Disabling the system extension and manually removing the System Keychain item labelled `clearancekit policy signing key` would prevent the forged-signature path but also disables policy enforcement.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00152 4th percentileScored 2026-11-07
Fix Fixed clearancekit (craigjbass): 5.0.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
craigjbassclearancekitbefore 5.0.105.0.10Patch availableCNA
  • clearancekit Vendorcraigjbass Affected before 5.0.10 Fixed in 5.0.10 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:craigjbass:clearancekit:*:*:*:*:*:*:*:*——craigjbass
  • cpe:2.3:a:craigjbass:clearancekit:*:*:*:*:*:*:*:* Versions — — ·craigjbass

Remediation

  • Fix · CNA clearancekit (craigjbass) Fixed in 5.0.10

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47134

References

Other 1

  • TI-2026-29335 ClearanceKit: Ad-hoc signed binaries can spoof Apple process identities in the global allowlist CVSS 4.0HIGH 8.4
  • TI-2026-26012 ClearanceKit: opfilter policy bypass via non-open file operations CVSS 3.1HIGH 8.7
  • TI-2026-26013 ClearanceKit: opfilter policy bypass via exchangedata and clone operations CVSS 4.0HIGH 8.4
  • TI-2026-29340 Protection mechanism failure in craigjbass clearancekit CVSS 4.0HIGH 8.2
  • TI-2026-29005 ClearanceKit has a policy bypass via dual-path Endpoint Security events checking only source path CVSS 4.0MEDIUM 6.8
  • TI-2026-34724 ClearanceKit's signed policy tables lack monotonic counter, allowing replay of older legitimately-signed snapshots CVSS 4.0MEDIUM 6.9
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences