CVE-2026-40599

N/A

Descripcion

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.5, ClearanceKit incorrectly treats a process with an empty Team ID and a non-empty Signing ID as an Apple platform binary. This bug allows a malicious software to impersonate an apple process in the global allowlist, and access all protected files. This vulnerability is fixed in 5.0.5.

Detalles CVE

Puntuacion CVSS v3.1N/A

Publicado4/21/2026

Ultima modificacion4/21/2026

Fuentenvd

Avistamientos honeypot0

Debilidades (CWE)

CWE-863

Referencias

https://github.com/craigjbass/clearancekit/security/advisories/GHSA-w253-42qp-5f2x(security-advisories@github.com)

https://github.com/craigjbass/clearancekit/security/advisories/GHSA-w253-42qp-5f2x(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.