PT-2026-28500 · Unknown · Clearancekit

Published 2026-03-26 · Updated 2026-03-26 · CVE-2026-33631

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions ClearanceKit versions 4.1 and earlier

Description ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. In versions on the 4.1 branch and earlier, the opfilter Endpoint Security system extension enforced file access policy by intercepting only ES EVENT TYPE AUTH OPEN events. Seven additional file operation event types were not intercepted, allowing any locally running process to bypass the configured FAA policy without triggering a denial. Commit a3d1733 adds subscriptions for all seven event types and routes them through the existing FAA policy evaluator. AUTH RENAME and AUTH UNLINK additionally preserve XProtect change detection, allowing events on the XProtect path to trigger the existing onXProtectChanged callback instead of being evaluated against user policy.

Recommendations Upgrade to ClearanceKit version 4.2 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-33631

Affected Products

Clearancekit

References · 6

• https://github.com/craigjbass/clearancekit/commit/a3d1733d2691a0d40209c48b01bf9291bf645207 · Patch
• https://github.com/craigjbass/clearancekit/security/advisories/GHSA-25f8-8cj2-m887 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33631 · Security Note
• https://twitter.com/TheHackerWire/status/2037267058497572932 · Twitter Post
• https://twitter.com/CveFindCom/status/2037269107423203574 · Twitter Post
• https://twitter.com/CVEnew/status/2037280577527930934 · Twitter Post