Is there a patch available for CVE-2026-47134?

Yes, a patch is available for CVE-2026-47134. Update the affected software to the latest version immediately.

ClearanceKit CVE-2026-47134

Q: What is the CVSS score of CVE-2026-47134?

CVE-2026-47134 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-46113 MEDIUM

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-07-20 GitHub_M

Information Disclosure Apple Clearancekit Craigjbass

6.9

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.0 MEDIUM

Root required (PR:H) and local-only access (AV:L); scope changes (S:C) because forged policy subverts enforcement across all ClearanceKit-controlled processes system-wide.

3.1 AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

4.0 AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 20, 2026 - 23:18 EUVD

Analysis Generated

Jul 20, 2026 - 21:48 vuln.today

CVE Published

Jul 20, 2026 - 21:17 cve.org

MEDIUM 6.9

DescriptionCVE.org

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. The ECDSA private key used to sign the on-disk policy database (/Library/Application Support/clearancekit/store.db) is stored in the macOS System Keychain. The key was created via the two-step pattern SecKeyCreateRandomKey (in-memory) followed by SecItemAdd(kSecValueRef:, kSecAttrAccess:) (persist). Prior to version 5.0.10, for kSecClassKey items in the legacy System Keychain, kSecAttrAccess passed to SecItemAdd is silently ignored - the persisted key inherits no ACL restriction. The same access builder applied to kSecClassGenericPassword items correctly binds the ACL, making this bug specific to the EC key. The result is that any process running as root can use the key to produce valid signatures over arbitrary policy content. Version 5.0.10 fixes the issue. No known workarounds are available. Disabling the system extension and manually removing the System Keychain item labelled clearancekit policy signing key would prevent the forged-signature path but also disables policy enforcement.

AnalysisAI

Policy signing key bypass in ClearanceKit prior to 5.0.10 permits any root process on macOS to forge valid signatures over arbitrary policy database content, granting full control over ClearanceKit's per-process file-system access enforcement plane. The root cause is a silent ACL failure specific to the macOS legacy System Keychain: ECDSA key items persisted via SecItemAdd silently lose their kSecAttrAccess restriction, leaving the signing key unrestricted to any root caller. No public exploit has been identified and no CISA KEV listing exists, but the integrity impact extends beyond the vulnerable component to the entire policy enforcement layer ClearanceKit provides.

Technical ContextAI

ClearanceKit (CPE: cpe:2.3:a:craigjbass:clearancekit:*:*:*:*:*:*:*:*) is a macOS system extension that intercepts file-system access events and enforces per-process access control policies stored in a signed SQLite database at /Library/Application Support/clearancekit/store.db. The signing key is an ECDSA private key stored in the macOS legacy System Keychain, created via SecKeyCreateRandomKey and persisted with SecItemAdd. The vulnerability maps to CWE-732 (Incorrect Permission Assignment for Critical Resource): on macOS, SecItemAdd silently discards the kSecAttrAccess parameter when persisting kSecClassKey items to the legacy System Keychain, while correctly applying it for kSecClassGenericPassword items. The developer intended the key to be ACL-restricted, but the persisted key inherits no restriction, making it accessible to any root process via the standard Security framework APIs. This is a macOS platform-specific API behavioral inconsistency, not a general cryptographic design flaw in ClearanceKit.

RemediationAI

Upgrade to ClearanceKit version 5.0.10, which corrects the ECDSA signing key ACL assignment in the macOS System Keychain. The vendor advisory at https://github.com/craigjbass/clearancekit/security/advisories/GHSA-w254-hxm5-3hgh should be consulted for upgrade and key rotation guidance, as existing deployments may have already persisted the unprotected key and a reinstallation or key refresh may be required to fully remediate. No functional workarounds preserve policy enforcement integrity: the only partial mitigation is disabling the ClearanceKit system extension and manually removing the System Keychain item labelled 'clearancekit policy signing key', which eliminates the forged-signature attack path but also completely disables file-system access policy enforcement - trading integrity bypass risk for total loss of the security control. This mitigation is only appropriate as a temporary measure in environments where ClearanceKit is not a critical compensating control, and immediate upgrade to 5.0.10 remains the only complete remediation.