Which versions of ClearanceKit are affected by CVE-2026-33632?

ClearanceKit macOS system extension versions before 4.2.4 contain a local authentication bypass that allows authenticated users to circumvent file access policies through unmonitored file operation…. A patch is available.

How to fix or mitigate CVE-2026-33632?

Within 24 hours: Audit current ClearanceKit deployment versions across all macOS endpoints and identify systems running versions prior to 4.2.4. Within 7 days: Deploy ClearanceKit version 4.2.4 to all affected systems using your standard macOS patch management process; reactivate system extensions post-update per vendor guidance. Within 30 days: Verify successful extension reactivation across all endpoints and validate that file access policy enforcement is functioning as intended through policy testing.

ClearanceKit CVE-2026-33632

Q: What is the CVSS score of CVE-2026-33632?

CVE-2026-33632 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16373 HIGH

Missing Authorization (CWE-862)

2026-03-26 GitHub_M

Apple Authentication Bypass

8.4

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.4 HIGH

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 21, 2026 - 15:16 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 21, 2026 - 15:07 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 06:13 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

4.2.4

EUVD ID Assigned

Mar 26, 2026 - 20:00 euvd

EUVD-2026-16373

Analysis Generated

Mar 26, 2026 - 20:00 vuln.today

CVE Published

Mar 26, 2026 - 19:32 nvd

HIGH 8.4

DescriptionGitHub Advisory

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 4.2.4, two file operation event types - ES_EVENT_TYPE_AUTH_EXCHANGEDATA and ES_EVENT_TYPE_AUTH_CLONE - were not intercepted by ClearanceKit's opfilter system extension, allowing local processes to bypass file access policies. Commit 6181c4a patches the vulnerability by subscribing to both event types and routing them through the existing policy evaluator. Users must upgrade to v4.2.4 or later and reactivate the system extension.

AnalysisAI

Local authenticated attackers can bypass file access policies in ClearanceKit (macOS system extension) versions prior to 4.2.4 by using specific file operation event types (ES_EVENT_TYPE_AUTH_EXCHANGEDATA and ES_EVENT_TYPE_AUTH_CLONE) that were not intercepted by the opfilter enforcement mechanism. This policy bypass allows unauthorized file access, modification, and data exfiltration despite configured access controls. EPSS exploitation probability is minimal (0.01%, 2nd percentile) and no active exploitation or public POC has been identified. Patch available in version 4.2.4 via commit 6181c4a, requiring system extension reactivation.

Technical ContextAI

ClearanceKit is a macOS system extension (specifically an EndpointSecurity framework-based opfilter) that enforces mandatory access control policies by intercepting file-system operations at the kernel level. The vulnerability stems from incomplete event subscription: the extension failed to register handlers for ES_EVENT_TYPE_AUTH_EXCHANGEDATA (atomic file exchange operation, historically used by exchangedata() system call) and ES_EVENT_TYPE_AUTH_CLONE (file cloning via clonefile/clonefileat APIs introduced in APFS). These operations could modify file content or create unauthorized copies without triggering policy evaluation. The root cause maps to CWE-862 (Missing Authorization), where authorization checks exist for most file operations but were absent for these two event types. The fix involves extending the event subscription mask and routing both event types through the existing policy evaluator framework that handles other file operations.

RemediationAI

Upgrade ClearanceKit to version 4.2.4 or later, which includes commit 6181c4a22eccbeca973c77f4bd023eb795c13786 that adds event subscriptions for ES_EVENT_TYPE_AUTH_EXCHANGEDATA and ES_EVENT_TYPE_AUTH_CLONE. After upgrading, the system extension MUST be reactivated (unload and reload) for the new event subscriptions to take effect - simply upgrading the binary without extension restart will leave the vulnerability exploitable. Verify reactivation by checking system extension status via systemextensionsctl list and confirming the new version is loaded. If immediate upgrade is not feasible, restrict local user privileges using principle of least privilege - limit which users have local authentication credentials and monitor file operation audit logs for unexpected exchangedata or clonefile syscalls. Note that macOS Transparency, Consent, and Control (TCC) provides independent file access restrictions but does not mitigate this ClearanceKit-specific bypass; organizations relying solely on ClearanceKit policies for sensitive file protection should prioritize this upgrade. No temporary workaround exists to enable the missing event subscriptions without code changes.