CVE-2026-33632: high-severity vulnerability in craigjbass clearancekit
ClearanceKit: opfilter policy bypass via exchangedata and clone operations
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.4epss 0.1%
ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 4.2.4, two file operation event types — ES_EVENT_TYPE_AUTH_EXCHANGEDATA and ES_EVENT_TYPE_AUTH_CLONE — were not intercepted by ClearanceKit's opfilter system extension, allowing local processes to bypass file access policies. Commit 6181c4a patches the vulnerability by subscribing to both event types and routing them through the existing policy evaluator. Users must upgrade to v4.2.4 or later and reactivate the system extension.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:N/SA:N
Affected products
craigjbass · clearancekitRelated CVEs — craigjbass clearancekit
In the same product, most dangerous first.
CVE-2026-34218MEDIUMClearanceKit: Managed and user-defined policy rules not enforced between opfilter start and first policy modificationEPSS 0.2%CVE-2026-47134MEDIUMClearanceKit: Policy signing key in System Keychain has permissive ACL allowing any local-root process to forge signed policyEPSS 0.2%CVE-2026-47133MEDIUMClearanceKit's signed policy tables lack monotonic counter, allowing replay of older legitimately-signed snapshotsEPSS 0.2%CVE-2026-40599HIGHClearanceKit: Ad-hoc signed binaries can spoof Apple process identities in the global allowlistEPSS 0.1%CVE-2026-40191MEDIUMClearanceKit has a policy bypass via dual-path Endpoint Security events checking only source pathEPSS 0.1%CVE-2026-40604HIGHClearanceKit: opfilter system extension can be suspended or signalled by a root process, disabling file-access policy enforcementEPSS 0.1%