CVE-2026-34218: Craigjbass Clearancekit

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 4.2.14, two related startup defects created a window during which only the single compile-time baseline rule was enforced by opfilter. All managed (MDM-delivered) and user-defined file-access rules were not applied until the user interacted with policies through the GUI, triggering a policy mutation over XPC. This issue has been patched in version 4.2.14.

Affected products

• Craigjbass Clearancekit: before 4.2.14 (fixed in 4.2.14)

Published 2026-03-31. Last modified 2026-07-24.