CVE-2026-47134

Received Received - Intake

ClearanceKit ECDSA Key ACL Bypass in macOS

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: GitHub, Inc.

Description

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. The ECDSA private key used to sign the on-disk policy database (`/Library/Application Support/clearancekit/store.db`) is stored in the macOS System Keychain. The key was created via the two-step pattern `SecKeyCreateRandomKey` (in-memory) followed by `SecItemAdd(kSecValueRef:, kSecAttrAccess:)` (persist). Prior to version 5.0.10, for `kSecClassKey` items in the legacy System Keychain, `kSecAttrAccess` passed to `SecItemAdd` is silently ignored — the persisted key inherits no ACL restriction. The same access builder applied to `kSecClassGenericPassword` items correctly binds the ACL, making this bug specific to the EC key. The result is that any process running as root can use the key to produce valid signatures over arbitrary policy content. Version 5.0.10 fixes the issue. No known workarounds are available. Disabling the system extension and manually removing the System Keychain item labelled `clearancekit policy signing key` would prevent the forged-signature path but also disables policy enforcement.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-07-20

Generated

2026-07-21

AI Q&A

2026-07-21

EPSS Evaluated

N/A

NVD

CVE-2026-47134

Affected Vendors & Products

Vendor	Product	Version / Range
clearancekit	clearancekit	to 5.0.10 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-732	The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Attack-Flow Graph

Executive Summary

ClearanceKit is a macOS tool that controls file access by enforcing policies signed with an ECDSA private key stored in the System Keychain. Due to a bug in versions before 5.0.10, the key's access restrictions were not properly applied when stored as a legacy System Keychain item. This allowed any root process to use the key to forge valid policy signatures.

Detection Guidance

Check for ClearanceKit installation and verify version is 5.0.10 or later. Inspect the System Keychain for the 'clearancekit policy signing key' item. Look for unauthorized root access to the key or policy database at /Library/Application Support/clearancekit/store.db.

Impact Analysis

An attacker with root access could forge policy signatures, bypassing ClearanceKit's file access controls. This could allow unauthorized file access or modification, potentially leading to data theft, system compromise, or disruption of protected operations.

Compliance Impact

This vulnerability could undermine compliance by allowing unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using ClearanceKit may fail audits if policies are not properly enforced due to forged signatures.

Mitigation Strategies

Update ClearanceKit to version 5.0.10 or later to fix the vulnerability. Alternatively, disable the system extension and remove the System Keychain item labeled 'clearancekit policy signing key' to prevent forged signatures, but this will also disable policy enforcement.

Hi! I’m here to help you understand CVE-2026-47134. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70