CVE-2026-47134: CWE-732: Incorrect Permission Assignment for Critical Resource in craigjbass clearancekit
ClearanceKit on macOS versions prior to 5.0.10 improperly assigns permissions to the ECDSA private key used for signing its on-disk policy database. The key is stored in the System Keychain without the intended access control list (ACL) restrictions, allowing any root process to use the key to forge valid policy signatures. This vulnerability is fixed in version 5.0.10. No known workarounds exist except disabling the system extension and removing the key, which disables policy enforcement.
AI Analysis
Technical Summary
ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. The ECDSA private key used to sign the policy database is stored in the macOS System Keychain. Prior to version 5.0.10, the access control list (ACL) intended to restrict key usage was silently ignored for kSecClassKey items, resulting in the key having no ACL restrictions. This allows any process running as root to use the key to produce valid signatures over arbitrary policy content, effectively bypassing policy enforcement. The issue is specific to EC keys and does not affect generic password items. Version 5.0.10 addresses this issue by properly enforcing ACL restrictions on the key.
Potential Impact
Any process with root privileges on affected versions can misuse the ECDSA private key to forge valid signatures on the policy database, potentially allowing unauthorized modification or bypass of ClearanceKit's file-system access policies. This undermines the integrity of the policy enforcement mechanism. There are no known exploits in the wild. The impact is limited to local root users.
Mitigation Recommendations
Version 5.0.10 of ClearanceKit fixes this vulnerability by properly enforcing ACL restrictions on the ECDSA private key in the System Keychain. Users should upgrade to version 5.0.10 or later. No other workarounds are available. Disabling the system extension and manually removing the System Keychain item labeled 'clearancekit policy signing key' prevents forged signatures but also disables policy enforcement, which may not be acceptable in many environments.
CVE-2026-47134: CWE-732: Incorrect Permission Assignment for Critical Resource in craigjbass clearancekit
Description
ClearanceKit on macOS versions prior to 5.0.10 improperly assigns permissions to the ECDSA private key used for signing its on-disk policy database. The key is stored in the System Keychain without the intended access control list (ACL) restrictions, allowing any root process to use the key to forge valid policy signatures. This vulnerability is fixed in version 5.0.10. No known workarounds exist except disabling the system extension and removing the key, which disables policy enforcement.
CVSS v4.0
Score 6.9medium
Affected software
pkg:github/craigjbass/clearancekitRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. The ECDSA private key used to sign the policy database is stored in the macOS System Keychain. Prior to version 5.0.10, the access control list (ACL) intended to restrict key usage was silently ignored for kSecClassKey items, resulting in the key having no ACL restrictions. This allows any process running as root to use the key to produce valid signatures over arbitrary policy content, effectively bypassing policy enforcement. The issue is specific to EC keys and does not affect generic password items. Version 5.0.10 addresses this issue by properly enforcing ACL restrictions on the key.
Potential Impact
Any process with root privileges on affected versions can misuse the ECDSA private key to forge valid signatures on the policy database, potentially allowing unauthorized modification or bypass of ClearanceKit's file-system access policies. This undermines the integrity of the policy enforcement mechanism. There are no known exploits in the wild. The impact is limited to local root users.
Mitigation Recommendations
Version 5.0.10 of ClearanceKit fixes this vulnerability by properly enforcing ACL restrictions on the ECDSA private key in the System Keychain. Users should upgrade to version 5.0.10 or later. No other workarounds are available. Disabling the system extension and manually removing the System Keychain item labeled 'clearancekit policy signing key' prevents forged signatures but also disables policy enforcement, which may not be acceptable in many environments.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-18T19:50:18.695Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5e92bf2a4a8d5989c4356f
Added to database: 07/20/2026, 21:27:27 UTC
Last enriched: 07/20/2026, 21:42:17 UTC
Last updated: 07/21/2026, 05:22:09 UTC
Views: 14
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.