CVE-2026-40599

N/A

Description

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.5, ClearanceKit incorrectly treats a process with an empty Team ID and a non-empty Signing ID as an Apple platform binary. This bug allows a malicious software to impersonate an apple process in the global allowlist, and access all protected files. This vulnerability is fixed in 5.0.5.

CVE Details

CVSS v3.1 ScoreN/A

Published4/21/2026

Last Modified4/21/2026

Sourcenvd

Honeypot Sightings0

Weaknesses (CWE)

CWE-863

References

https://github.com/craigjbass/clearancekit/security/advisories/GHSA-w253-42qp-5f2x(security-advisories@github.com)

https://github.com/craigjbass/clearancekit/security/advisories/GHSA-w253-42qp-5f2x(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.