PT-2026-28501 · Unknown · Clearancekit

Published 2026-03-26 · Updated 2026-03-26 · CVE-2026-33632

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ClearanceKit versions prior to 4.2.4

Description ClearanceKit monitors file system access events on macOS and enforces access policies on a per-process basis. Before version 4.2.4, two file operation event types—ES EVENT TYPE AUTH EXCHANGEDATA and ES EVENT TYPE AUTH CLONE—were not intercepted by ClearanceKit’s opfilter system extension. This allowed local processes to bypass file access policies. The issue was addressed in commit 6181c4a by subscribing to both event types and routing them through the existing policy evaluator.

Recommendations Upgrade to version 4.2.4 or later and reactivate the system extension.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-33632

GHSA-WPXJ-VHFP-HHVM

Affected Products

Clearancekit

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33632.json · Exploit
• https://github.com/craigjbass/clearancekit/commit/6181c4a22eccbeca973c77f4bd023eb795c13786 · Patch
• https://github.com/craigjbass/clearancekit/security/advisories/GHSA-wpxj-vhfp-hhvm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33632 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33632 · Security Note
• https://twitter.com/CVEnew/status/2037280575489474830 · Twitter Post