CVE-2026-33632

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33632
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33632.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-33632
Aliases
  • GHSA-wpxj-vhfp-hhvm
Published
2026-03-26T19:32:49.565Z
Modified
2026-04-02T13:41:29.453660Z
Severity
  • 8.4 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:N/SA:N CVSS Calculator
Summary
ClearanceKit: opfilter policy bypass via exchangedata and clone operations
Details

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 4.2.4, two file operation event types — ESEVENTTYPEAUTHEXCHANGEDATA and ESEVENTTYPEAUTHCLONE — were not intercepted by ClearanceKit's opfilter system extension, allowing local processes to bypass file access policies. Commit 6181c4a patches the vulnerability by subscribing to both event types and routing them through the existing policy evaluator. Users must upgrade to v4.2.4 or later and reactivate the system extension.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33632.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-862"
    ]
}
References

Affected packages

Git / github.com/craigjbass/clearancekit

Affected ranges

Type
GIT
Repo
https://github.com/craigjbass/clearancekit
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6181c4a22eccbeca973c77f4bd023eb795c13786
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.2.4"
        }
    ]
}

Affected versions

v3.*
v3.1-1480877
v3.1-1c065f7
v3.1-2bc8773
v3.1-34107d6
v3.1-56cf8aa
v3.1-781fe68
v3.1-9444cb6
v3.1-962116d
v3.1-9ae9a1e
v3.1-a563b4b
v3.1-b616763
v3.1-bab7abf
v3.1-def8687
v3.1-f48c585
v3.1-f9c7713
v3.2-9bb23fd
v3.3-9bb62a6
v4.*
v4.0-19126ba
v4.0-2ccd30f
v4.0-3f01958
v4.0-5a0de89
v4.0-8fc8884
v4.0-b574aa3
v4.0-c828d5e
v4.0-db67c62
v4.0-e2705e0
v4.0-eca88d7
v4.0-f8c9232
v4.1-16a3e37
v4.1-3594f78
v4.1-6bcaabe
v4.1-8386ae0
v4.1-981728f
v4.1-df4a170
v4.1-dfed70f
v4.1-fd5fab3
v4.2-10c19ed
v4.2-3379a1c
v4.2-64f154d
v4.2-9997343
v4.2-a6926d4
v4.2-da58a49
v4.2-f5f9534
v4.2.1-7b10538
v4.2.2-d44ae9d
v4.2.3-d488a1e

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33632.json"