File Access Policy Bypass in ClearanceKit on macOS
CVE-2026-33632

8.4HIGH

Key Information:

Vendor

Craigjbass

Status
Clearancekit
Vendor
CVE Published:
26 March 2026

What is CVE-2026-33632?

ClearanceKit is a file-system access management tool for macOS designed to enforce per-process access policies. However, prior to version 4.2.4, it failed to intercept specific file operation events, namely ES_EVENT_TYPE_AUTH_EXCHANGEDATA and ES_EVENT_TYPE_AUTH_CLONE, which allowed local processes to circumvent established file access policies. This oversight exposed users to potential unauthorized access. The vulnerability has been addressed in commit 6181c4a, which enhances the system extension by subscribing to the previously unmonitored event types and routing them through the existing policy evaluator. Users are advised to upgrade to version 4.2.4 or later and ensure the system extension is reactivated to protect against this security issue.

Affected Version(s)

clearancekit < 4.2.4

References

https://github.com/craigjbass/clearancekit/security/advis...
x_refsource_CONFIRM
https://github.com/craigjbass/clearancekit/commit/6181c4a...
x_refsource_MISC

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.