CVE-2026-47133 Details
Description
ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 5.0.10, each table in the on-disk SQLite policy store (`/Library/Application Support/clearancekit/store.db`) is verified using an ECDSA signature stored in the `data_signatures` table. The signed payload contains only the canonical row content, with no version counter or freshness binding. An attacker who can write `store.db` and the matching `data_signatures` row — feasible during the opfilter-update window when the Endpoint Security filter is offline, or via offline-boot / decrypted-backup scenarios — can substitute a previously-captured legitimately-signed snapshot. opfilter accepts the older snapshot as fully valid on next boot because the existing signatures still verify. Version 5.0.10 patches the issue.
A vulnerability in ClearanceKit prior to version 5.0.10 allows for the replay of older, legitimately-signed policy snapshots. This issue arises because the ECDSA signatures used to verify policy tables in the SQLite policy store lack a version counter or freshness binding. An attacker with local root access can exploit this vulnerability by writing to the 'store.db' file and the corresponding 'data_signatures' row, particularly during the opfilter-update window when the Endpoint Security filter is offline, or through offline-boot or decrypted-backup scenarios. By substituting a previously-captured signed snapshot, the opfilter will accept it as valid on the next boot, effectively rolling back policy changes or re-enabling disabled feature flags.
Users can update to ClearanceKit version 5.0.10 or later, where this vulnerability has been patched by introducing an epoch ratchet that adds a monotonically increasing counter to the signed policy tables, ensuring proper freshness binding and preventing signature replay.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 20, 2026CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/craigjbass/clearancekit/security/advisories/GHSA-9hx3-5wp9-2qqg | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-294 | Authentication Bypass by Capture-replay | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ClearanceKit | < 5.0.10 (semver) = 5.0.10-beta-eab3c5d (semver) = 5.0.10-beta-c1747fa (semver) = 5.0.10-beta-42fc946 (semver) = 5.0.10-beta-f7a57d6 (semver) = 5.0.10-beta-a7227fa (semver) = 5.0.10-beta-324dedc (semver) = 5.0.10-beta-b98d3cd (semver) = 5.0.10-beta-578aebc (semver) = 5.0.10-beta-e34820d (semver) = 5.0.10-beta-1ecf73c (semver) = 5.0.10-beta-f4fba42 (semver) = 5.0.10-beta-40894f9 (semver) = 5.0.10-beta-8e0a2e7 (semver) |
CPE
Remediation
| |
| uk.craigbass.clearancekit.opfilter | < 5.0.10 (semver) = 5.0.10-beta-eab3c5d (semver) = 5.0.10-beta-c1747fa (semver) = 5.0.10-beta-42fc946 (semver) = 5.0.10-beta-f7a57d6 (semver) = 5.0.10-beta-a7227fa (semver) = 5.0.10-beta-324dedc (semver) = 5.0.10-beta-b98d3cd (semver) = 5.0.10-beta-578aebc (semver) = 5.0.10-beta-e34820d (semver) = 5.0.10-beta-1ecf73c (semver) = 5.0.10-beta-f4fba42 (semver) = 5.0.10-beta-40894f9 (semver) = 5.0.10-beta-8e0a2e7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |