CVE-2026-47133: Craigjbass Clearancekit

Medium severity, CVSS 6.9. EPSS: 0.2% chance of exploitation in the next 30 days.

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 5.0.10, each table in the on-disk SQLite policy store (`/Library/Application Support/clearancekit/store.db`) is verified using an ECDSA signature stored in the `data_signatures` table. The signed payload contains only the canonical row content, with no version counter or freshness binding. An attacker who can write `store.db` and the matching `data_signatures` row — feasible during the opfilter-update window when the Endpoint Security filter is offline, or via offline-boot / decrypted-backup scenarios — can substitute a previously-captured legitimately-signed snapshot. opfilter accepts the older snapshot as fully valid on next boot because the existing signatures still verify. Version 5.0.10 patches the issue.

Affected products

• Craigjbass Clearancekit: before 5.0.10 (fixed in 5.0.10)

Published 2026-07-20. Last modified 2026-07-23.