ClearanceKit CVE-2026-40604

Upgrade ClearanceKit to version 5.0.6 or later, which implements proper protection against signal-based attacks on the opfilter system extension. The update can be obtained from the vendor's GitHub repository referenced in the security advisory at https://github.com/craigjbass/clearancekit/security/advisories/GHSA-5r9w-9fg6-266q. For environments unable to immediately upgrade, implement compensating controls by restricting which processes can run with root privileges through mandatory access controls external to ClearanceKit (such as TCC restrictions or third-party privilege management solutions), though this has limited effectiveness since the vulnerability itself requires root access. Monitor system logs for unexpected termination or suspension of the opfilter extension process (look for SIGSTOP/SIGKILL/SIGTERM events against processes with bundle ID uk.craigbass.clearancekit.opfilter), which may indicate exploitation attempts, though legitimate administrative actions could also trigger these signals. Note that there is no effective workaround that preserves both ClearanceKit functionality and prevents this bypass - the only complete remediation is upgrading to the patched version.