CVE-2026-40599

N/A

Descricao

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.5, ClearanceKit incorrectly treats a process with an empty Team ID and a non-empty Signing ID as an Apple platform binary. This bug allows a malicious software to impersonate an apple process in the global allowlist, and access all protected files. This vulnerability is fixed in 5.0.5.

Detalhes CVE

Pontuacao CVSS v3.1N/A

Publicado4/21/2026

Ultima modificacao4/21/2026

Fontenvd

Avistamentos honeypot0

Fraquezas (CWE)

CWE-863

Referencias

https://github.com/craigjbass/clearancekit/security/advisories/GHSA-w253-42qp-5f2x(security-advisories@github.com)

https://github.com/craigjbass/clearancekit/security/advisories/GHSA-w253-42qp-5f2x(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.