CVE-2026-33632: fallo de gravedad alta en craigjbass clearancekit
ClearanceKit: opfilter policy bypass via exchangedata and clone operations
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.4epss 0.1%
ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 4.2.4, two file operation event types — ES_EVENT_TYPE_AUTH_EXCHANGEDATA and ES_EVENT_TYPE_AUTH_CLONE — were not intercepted by ClearanceKit's opfilter system extension, allowing local processes to bypass file access policies. Commit 6181c4a patches the vulnerability by subscribing to both event types and routing them through the existing policy evaluator. Users must upgrade to v4.2.4 or later and reactivate the system extension.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:N/SA:N
Productos afectados
craigjbass · clearancekitCVEs relacionadas — craigjbass clearancekit
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-34218MEDIUMClearanceKit: Managed and user-defined policy rules not enforced between opfilter start and first policy modificationEPSS 0.2%CVE-2026-47134MEDIUMClearanceKit: Policy signing key in System Keychain has permissive ACL allowing any local-root process to forge signed policyEPSS 0.2%CVE-2026-47133MEDIUMClearanceKit's signed policy tables lack monotonic counter, allowing replay of older legitimately-signed snapshotsEPSS 0.2%CVE-2026-40599HIGHClearanceKit: Ad-hoc signed binaries can spoof Apple process identities in the global allowlistEPSS 0.1%CVE-2026-40191MEDIUMClearanceKit has a policy bypass via dual-path Endpoint Security events checking only source pathEPSS 0.1%CVE-2026-40604HIGHClearanceKit: opfilter system extension can be suspended or signalled by a root process, disabling file-access policy enforcementEPSS 0.1%