CVE-2026-40191

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-40191
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40191.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-40191
Aliases
  • GHSA-92f3-38m7-579h
Published
2026-04-10T20:19:35.909Z
Modified
2026-08-04T11:50:53.263711334Z
Severity
  • 6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
ClearanceKit has a policy bypass via dual-path Endpoint Security events checking only source path
Details

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.4-beta-1f46165, ClearanceKit's Endpoint Security event handler only checked the source path of dual-path file operations against File Access Authorization (FAA) rules and App Jail policies. The destination path was ignored entirely. This allowed any local process to bypass file-access protection by using rename, link, copyfile, exchangedata, or clone operations to place or replace files inside protected directories. This vulnerability is fixed in 5.0.4-beta-1f46165.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40191.json",
    "cwe_ids": [
        "CWE-863"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/craigjbass/clearancekit

Affected ranges

Type
GIT
Repo
https://github.com/craigjbass/clearancekit
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1f461653d6a0afa02d5b922441ddedb7fb4433fb
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.0.4-beta-1f46165"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v3.*
v3.1-1480877
v3.1-1c065f7
v3.1-2bc8773
v3.1-34107d6
v3.1-56cf8aa
v3.1-781fe68
v3.1-9444cb6
v3.1-962116d
v3.1-9ae9a1e
v3.1-a563b4b
v3.1-b616763
v3.1-bab7abf
v3.1-def8687
v3.1-f48c585
v3.1-f9c7713
v3.2-9bb23fd
v3.3-9bb62a6
v4.*
v4.0-19126ba
v4.0-2ccd30f
v4.0-3f01958
v4.0-5a0de89
v4.0-8fc8884
v4.0-b574aa3
v4.0-c828d5e
v4.0-db67c62
v4.0-e2705e0
v4.0-eca88d7
v4.0-f8c9232
v4.1-16a3e37
v4.1-3594f78
v4.1-6bcaabe
v4.1-8386ae0
v4.1-981728f
v4.1-df4a170
v4.1-dfed70f
v4.1-fd5fab3
v4.2-10c19ed
v4.2-3379a1c
v4.2-64f154d
v4.2-9997343
v4.2-a6926d4
v4.2-da58a49
v4.2-f5f9534
v4.2.1-7b10538
v4.2.1-beta-0943b9a
v4.2.1-beta-1446c6b
v4.2.10-beta-1bd9a4b
v4.2.10-beta-d078fba
v4.2.10-d078fba
v4.2.11-97eb073
v4.2.11-beta-caef71c
v4.2.11-beta-f1afa86
v4.2.12-beta-25c25f0
v4.2.12-beta-2bd354b
v4.2.12-beta-3ce0726
v4.2.12-beta-4e235b6
v4.2.12-beta-6eadd6a
v4.2.12-beta-70dd223
v4.2.12-beta-8a28803
v4.2.12-beta-97eb073
v4.2.12-beta-9cfec23
v4.2.12-beta-9dd7fc2
v4.2.12-beta-c380cfb
v4.2.12-beta-ddfdacb
v4.2.12-beta-e9b99e2
v4.2.13-ddfdacb
v4.2.14-56d617b
v4.2.14-beta-56d617b
v4.2.15-328eb4e
v4.2.15-beta-328eb4e
v4.2.15-beta-59ab090
v4.2.15-beta-cb9c418
v4.2.16-95857bc
v4.2.17-b8d4b62
v4.2.17-beta-4a39af5
v4.2.17-beta-59eff6c
v4.2.17-beta-6bb5985
v4.2.17-beta-95857bc
v4.2.17-beta-b8d4b62
v4.2.17-beta-bb1bdb1
v4.2.18-beta-0d98e32
v4.2.18-beta-11a86c5
v4.2.18-beta-1b38d48
v4.2.18-beta-34a5b45
v4.2.18-beta-399ecc9
v4.2.18-beta-540674b
v4.2.18-beta-5816088
v4.2.18-beta-5e23596
v4.2.18-beta-669d4f1
v4.2.18-beta-a404264
v4.2.18-beta-b228019
v4.2.18-beta-bcc4fad
v4.2.18-beta-cb13685
v4.2.18-beta-cb50d47
v4.2.18-beta-d510cbd
v4.2.18-beta-dc80da5
v4.2.18-beta-fcd63f2
v4.2.18-beta-fd775e1
v4.2.18-beta-ff065b5
v4.2.2-d44ae9d
v4.2.3-d488a1e
v4.2.4-6181c4a
v4.2.5-0ab246c
v4.2.6-beta-0ba8b30
v4.2.6-beta-4a29601
v4.2.6-beta-505afd6
v4.2.6-beta-521fc32
v4.2.6-beta-5554edf
v4.2.6-beta-688192a
v4.2.6-beta-77386f2
v4.2.6-beta-9cab2ff
v4.2.6-beta-a77902b
v4.2.6-beta-e3bced6
v4.2.6-beta-e3e33ea
v4.2.6-beta-e3fec11
v4.2.6-beta-e92e21e
v4.2.6-beta-e9d43ea
v4.2.6-beta-ec8db39
v4.2.6-e3bced6
v4.2.7-1c782a1
v4.2.7-beta-1c782a1
v4.2.7-beta-1cc0a77
v4.2.7-beta-268aa55
v4.2.7-beta-65c19c6
v4.2.7-beta-7ad2f7d
v4.2.7-beta-88b2b3a
v4.2.7-beta-b39d99a
v4.2.7-beta-e0e2967
v4.2.8-beta-046a61a
v4.2.8-beta-11ee34c
v4.2.8-beta-14393bb
v4.2.8-beta-1c17230
v4.2.8-beta-23e30c5
v4.2.8-beta-2f491e6
v4.2.8-beta-34142ac
v4.2.8-beta-3440884
v4.2.8-beta-723e90c
v4.2.8-beta-844141b
v4.2.8-beta-8df99b8
v4.2.8-beta-941ba0d
v4.2.8-beta-954bb2a
v4.2.8-beta-96049f8
v4.2.8-beta-9ab4936
v4.2.8-beta-9f81d2d
v4.2.8-beta-aa06e60
v4.2.8-beta-e9ab07b
v4.2.8-beta-f1a2de7
v4.2.8-beta-f51fc8e
v4.2.8-beta-f55f283
v4.2.8-beta-f606b7a
v4.2.8-beta-f84e3d4
v4.2.8-beta-fcbe4ec
v4.2.8-e9ab07b
v4.2.9-1bd9a4b
v4.2.9-beta-0a8cd29
v4.2.9-beta-0c7f3d1
v4.2.9-beta-17cd99f
v4.2.9-beta-217a1fb
v4.2.9-beta-25e1230
v4.2.9-beta-2924fec
v4.2.9-beta-2c78ce1
v4.2.9-beta-3a9e8c7
v4.2.9-beta-43f52c8
v4.2.9-beta-48d9e4b
v4.2.9-beta-52d3a07
v4.2.9-beta-58ad180
v4.2.9-beta-5ffabaf
v4.2.9-beta-690e5fd
v4.2.9-beta-6f2122a
v4.2.9-beta-704d137
v4.2.9-beta-7768ef9
v4.2.9-beta-7d215cd
v4.2.9-beta-88a324e
v4.2.9-beta-8b7f499
v4.2.9-beta-8fcabc9
v4.2.9-beta-ba38640
v4.2.9-beta-c21ad1e
v4.2.9-beta-c9f6efa
v4.2.9-beta-cd8eec6
v4.2.9-beta-db4dee9
v4.2.9-beta-e5bed60
v4.2.9-beta-eed8ad3
v4.2.9-beta-f5efabc
v4.2.9-beta-fe1590d
v5.*
v5.0.1-55e1b25
v5.0.1-beta-2886304
v5.0.1-beta-2988ac7
v5.0.1-beta-3070e48
v5.0.1-beta-55e1b25
v5.0.1-beta-88cd8c1
v5.0.1-beta-8ac14af
v5.0.1-beta-94efede
v5.0.1-beta-aa7d36b
v5.0.1-beta-b406f51
v5.0.1-beta-bdb58cc
v5.0.1-beta-c1cbf74
v5.0.1-beta-c21325f
v5.0.1-beta-c621aac
v5.0.1-beta-c8303f6
v5.0.1-beta-c9010bb
v5.0.1-beta-cfb81ad
v5.0.1-beta-efaff77
v5.0.1-beta-f579cfc
v5.0.2-4777d0a
v5.0.3-beta-053aa03
v5.0.3-beta-12221d5
v5.0.3-beta-15553e6
v5.0.3-beta-243623e
v5.0.3-beta-3096770
v5.0.3-beta-331cf56
v5.0.3-beta-3a6d0ed
v5.0.3-beta-461181a
v5.0.3-beta-4777d0a
v5.0.3-beta-4aac24c
v5.0.3-beta-59d40fd
v5.0.3-beta-6a92223
v5.0.3-beta-73a4f68
v5.0.3-beta-758469d
v5.0.3-beta-89dfe46
v5.0.3-beta-b19e6a0
v5.0.3-beta-b8ebe86
v5.0.3-beta-ca0cb45
v5.0.3-beta-ca77b7c
v5.0.3-beta-cd6f912
v5.0.3-beta-dd6bc64
v5.0.3-beta-e3ae3ee
v5.0.3-e353aa8
v5.0.4-beta-2441e70
v5.0.4-beta-2ab3798
v5.0.4-beta-3005356
v5.0.4-beta-4343a17
v5.0.4-beta-746c770
v5.0.4-beta-7795456
v5.0.4-beta-7c520a0
v5.0.4-beta-90ffdf2
v5.0.4-beta-9bf3d64
v5.0.4-beta-a993d34
v5.0.4-beta-d203f0e
v5.0.4-beta-e353aa8
v5.0.4-beta-fc9d6f7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40191.json"