CVE-2026-47134 - ClearanceKit Vulnerability Exposed

CVE-2026-47134 - ClearanceKit Vulnerability 🚨

A critical vulnerability, identified as CVE-2026-47134, has been reported regarding ClearanceKit. This vulnerability allows any local-root process to forge signed policy due to a permissive ACL in the System Keychain. ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies.

The ECDSA private key used to sign the on-disk policy database (/Library/Application Support/clearancekit/store.db) is stored in the macOS System Keychain. The vulnerability arises from how the key was created using the two-step pattern SecKeyCreateRandomKey (in-memory) followed by SecItemAdd(kSecValueRef:, kSecAttrAccess:) (persist).

Affected Products

The following products are affected by the CVE-2026-47134 vulnerability. Although cvefeed.io is aware of the exact versions of the affected products, this information is not represented in the table below. The vulnerability stems from the fact that prior to version 5.0.10, for kSecClassKey items in the legacy System Keychain, the kSecAttrAccess passed to SecItemAdd is silently ignored, meaning the persisted key inherits no ACL restriction. This bug is specific to the EC key, allowing any process running as root to produce valid signatures over arbitrary policy content.

Resolution

Version 5.0.10 fixes the issue. No known workarounds are available. Disabling the system extension and manually removing the System Keychain item labelled clearancekit policy signing key would prevent the forged-signature path but also disables policy enforcement. To resolve the keychain access issue, update ClearanceKit to version 5.0.10 and remove the Keychain item labelled ‘clearancekit policy signing key’.

CVE-2026-47134 is associated with CWE-732: Incorrect Permission Assignment for Critical Resource.

For more details, Read full article