CVE-2026-47133

Received Received - Intake

ClearanceKit macOS Policy Bypass via Stale Signed Snapshots

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 5.0.10, each table in the on-disk SQLite policy store (`/Library/Application Support/clearancekit/store.db`) is verified using an ECDSA signature stored in the `data_signatures` table. The signed payload contains only the canonical row content, with no version counter or freshness binding. An attacker who can write `store.db` and the matching `data_signatures` row — feasible during the opfilter-update window when the Endpoint Security filter is offline, or via offline-boot / decrypted-backup scenarios — can substitute a previously-captured legitimately-signed snapshot. opfilter accepts the older snapshot as fully valid on next boot because the existing signatures still verify. Version 5.0.10 patches the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-07-20

Generated

2026-07-21

AI Q&A

2026-07-21

EPSS Evaluated

N/A

NVD

CVE-2026-47133

Affected Vendors & Products

Vendor	Product	Version / Range
clearancekit	clearancekit	5.0.10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-294	A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

Executive Summary

ClearanceKit is a macOS tool that controls file access by enforcing policies stored in an SQLite database. Before version 5.0.10, it verified these policies using ECDSA signatures without version tracking. An attacker could replace the current policy database with an older, legitimately signed version during a brief update window or offline scenarios. The system would accept the older version as valid on reboot because the signatures still checked out.

Detection Guidance

Check for unauthorized modifications to /Library/Application Support/clearancekit/store.db or the presence of outdated policy snapshots. Verify the ECDSA signatures in the data_signatures table match expected values. Inspect system logs for opfilter-update windows or offline-boot events.

Impact Analysis

If exploited, an attacker could downgrade your security policies to an older, less restrictive state. This might allow unauthorized file access, bypassing intended protections. The attack requires write access to the policy database during a specific window or offline access, making it a targeted rather than widespread risk.

Compliance Impact

This vulnerability could undermine compliance with GDPR and HIPAA by allowing unauthorized access to sensitive data. If an attacker replaces the policy store with a previously signed snapshot, they could bypass access controls, potentially leading to unauthorized data access or exfiltration. This violates principles of data integrity and confidentiality required by these regulations.

Mitigation Strategies

Update ClearanceKit to version 5.0.10 or later to patch the ECDSA signature verification flaw in the SQLite policy store.

Hi! I’m here to help you understand CVE-2026-47133. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70