CVE-2026-34218
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
ClearanceKit has a startup defect where only compile-time rules are enforced until user interacts with GUI. MDM and user-defined rules are not applied.
Risk Assessment
During the startup window, file access rules are not fully enforced, potentially allowing unauthorized processes to access protected files.
Recommendation
Update ClearanceKit to version 4.2.14 or later.
Original NVD description (English source)
ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 4.2.14, two related startup defects created a window during which only the single compile-time baseline rule was enforced by opfilter. All managed (MDM-delivered) and user-defined file-access rules were not applied until the user interacted with policies through the GUI, triggering a policy mutation over XPC. This issue has been patched in version 4.2.14.