CVE-2026-47134
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In ClearanceKit before version 5.0.10, the ECDSA key used to sign the policy database is stored in the macOS keychain without ACL restrictions. Any root process can use this key to sign arbitrary policy content.
Risk Assessment
An attacker with root privileges can forge access policies, bypassing ClearanceKit security mechanisms.
Recommendation
Update ClearanceKit to version 5.0.10. If update is not possible, consider disabling the system extension and manually removing the key from the keychain.
Other vulnerabilities in ClearanceKit
See all- CVE-2026-47133Medium
In ClearanceKit before version 5.0.10, ECDSA signatures for SQLite database tables lack a version counter or freshness binding. An attacker can replace the database and signatures with an older, legitimately signed version, which will be accepted by the system.
- CVE-2026-34218Medium
ClearanceKit has a startup defect where only compile-time rules are enforced until user interacts with GUI. MDM and user-defined rules are not applied.
Original NVD description (English source)
ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. The ECDSA private key used to sign the on-disk policy database (`/Library/Application Support/clearancekit/store.db`) is stored in the macOS System Keychain. The key was created via the two-step pattern `SecKeyCreateRandomKey` (in-memory) followed by `SecItemAdd(kSecValueRef:, kSecAttrAccess:)` (persist). Prior to version 5.0.10, for `kSecClassKey` items in the legacy System Keychain, `kSecAttrAccess` passed to `SecItemAdd` is silently ignored — the persisted key inherits no ACL restriction. The same access builder applied to `kSecClassGenericPassword` items correctly binds the ACL, making this bug specific to the EC key. The result is that any process running as root can use the key to produce valid signatures over arbitrary policy content. Version 5.0.10 fixes the issue. No known workarounds are available. Disabling the system extension and manually removing the System Keychain item labelled `clearancekit policy signing key` would prevent the forged-signature path but also disables policy enforcement.