CVE-2026-33631
HighSummary
ClearanceKit przechwytuje zdarzenia dostępu do systemu plików w macOS i egzekwuje polityki dostępu na poziomie procesów. W wersjach z gałęzi 4.1 i wcześniejszych, system rozszerzeń Endpoint Security egzekwował politykę dostępu do plików wyłącznie poprzez przechwytywanie zdarzeń ES_EVENT_TYPE_AUTH_OPEN, co pozwalało na obejście polityki FAA przez lokalnie działające procesy.
Risk Assessment
Brak przechwytywania siedmiu dodatkowych typów zdarzeń operacji na plikach stwarza ryzyko, że lokalne procesy mogą omijać skonfigurowane polityki dostępu, co może prowadzić do nieautoryzowanego dostępu do danych.
Recommendation
Zaleca się aktualizację do wersji 4.2 lub nowszej, która zawiera poprawki eliminujące tę podatność. Brak znanych obejść dla tej luki.
Related vulnerabilities
- CVE-2026-90898Critical
Bifrost registers MCP clients through its management API, where a stdio client is a command plus args that is started immediately upon client addition, with no MCP handshake required. Authentication is disabled by default (governance.auth_config.is_enabled=false), meaning every caller is treated as a local admin. A single unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image).
- CVE-2026-90703Critical
A vulnerability has been found in D-Link DWR-M921 1.1.52 in the system function of the file /boafrm/formDiskCreateShare. Manipulation of the folderpath argument leads to OS command injection. The attack can be launched remotely, and the exploit has been publicly disclosed and may be used.
- CVE-2026-90702Critical
A flaw has been found in D-Link DWR-M921 1.1.52 in the system function of the file /boafrm/formDiskFormat. Manipulation of the partition argument causes OS command injection. The attack may be initiated remotely, and the exploit has been published and may be used.
- CVE-2026-90699Critical
A weakness has been identified in D-Link DWR-M920 1.1.7 affecting the sub_41E60C function of the file /boafrm/formPinManageSetup. Manipulation of the newPin argument causes OS command injection. The attack can be initiated remotely, and the exploit has been made available to the public and could be used for attacks.
- CVE-2026-90693Critical
A flaw has been found in D-Link DIR-878 120B05 impacting the SetWan3Settings function of the WAN Settings component. Manipulation of the Primary/Secondary argument causes a stack-based buffer overflow. Remote exploitation of the attack is possible.
- CVE-2026-90692Critical
A vulnerability was detected in D-Link DIR-878 120B05 affecting the SetDynamicDNSIPv6Settings function of the Dynamic DNS IPv6 Settings component. Manipulation of the IPv6Address/Hostname argument results in a stack-based buffer overflow. The attack may be launched remotely.
- CVE-2026-85192Critical
The Joomla Conditional Content extension (regularlabs.com) in versions < 8.0.0 allows authenticated, privileged remote code execution. Conditional Content Pro accepts inline PHP Condition Rules in article syntax, and in affected versions the PHP is passed to the Conditions evaluator without checking who authored the article. Joomla's normal Author text filter preserves the syntax, so publishing the article causes the code to run as the web-server process.
- CVE-2026-82787Critical
A missing authentication for critical function vulnerability exists in CPSL-08P1EN. If this vulnerability is exploited, an affected product may be operated by a remote attacker without authentication.
- CVE-2026-90680Critical
A stack-based buffer overflow vulnerability was discovered in D-Link DIR-823G version 1.0.2B05_20181207, in the strcpy function of /HNAP1/SetStaticRouteSettings (HNAP1 component). Manipulating the PAddress/SubnetMask/Gateway arguments triggers the overflow. The attack can be launched remotely.
- CVE-2026-90608Critical
A buffer overflow vulnerability was found in Totolink A3002MU version Hh-B20211125.1046, in the formPortFw function of /boafrm/formPortFw (boa component). Manipulating the service_type argument causes the overflow. The attack can be initiated remotely and the exploit has been published.
Original NVD description (English source)
ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. In versions on the 4.1 branch and earlier, the opfilter Endpoint Security system extension enforced file access policy exclusively by intercepting ES_EVENT_TYPE_AUTH_OPEN events. Seven additional file operation event types were not intercepted, allowing any locally running process to bypass the configured FAA policy without triggering a denial. Commit a3d1733 adds subscriptions for all seven event types and routes them through the existing FAA policy evaluator. AUTH_RENAME and AUTH_UNLINK additionally preserve XProtect change detection: events on the XProtect path are allowed and trigger the existing onXProtectChanged callback rather than being evaluated against user policy. All versions on the 4.2 branch contain the fix. No known workarounds are available.