CVE-2026-47133

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-47133
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47133.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-47133
Aliases
  • GHSA-9hx3-5wp9-2qqg
Published
2026-07-20T21:12:26.245Z
Modified
2026-07-25T03:56:19.324355944Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N CVSS Calculator
Summary
ClearanceKit's signed policy tables lack monotonic counter, allowing replay of older legitimately-signed snapshots
Details

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 5.0.10, each table in the on-disk SQLite policy store (/Library/Application Support/clearancekit/store.db) is verified using an ECDSA signature stored in the data_signatures table. The signed payload contains only the canonical row content, with no version counter or freshness binding. An attacker who can write store.db and the matching data_signatures row — feasible during the opfilter-update window when the Endpoint Security filter is offline, or via offline-boot / decrypted-backup scenarios — can substitute a previously-captured legitimately-signed snapshot. opfilter accepts the older snapshot as fully valid on next boot because the existing signatures still verify. Version 5.0.10 patches the issue.

Database specific 
{
    "cwe_ids": [
        "CWE-294"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47133.json"
}
References

Affected packages

Git / github.com/craigjbass/clearancekit

Affected ranges

Type
GIT
Repo
https://github.com/craigjbass/clearancekit
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
afb9006638e4fd8bd1b134b26bb938b5b22d85b4
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.0.10"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v3.*
v3.1-1480877
v3.1-1c065f7
v3.1-2bc8773
v3.1-34107d6
v3.1-56cf8aa
v3.1-781fe68
v3.1-9444cb6
v3.1-962116d
v3.1-9ae9a1e
v3.1-a563b4b
v3.1-b616763
v3.1-bab7abf
v3.1-def8687
v3.1-f48c585
v3.1-f9c7713
v3.2-9bb23fd
v3.3-9bb62a6
v4.*
v4.0-19126ba
v4.0-2ccd30f
v4.0-3f01958
v4.0-5a0de89
v4.0-8fc8884
v4.0-b574aa3
v4.0-c828d5e
v4.0-db67c62
v4.0-e2705e0
v4.0-eca88d7
v4.0-f8c9232
v4.1-16a3e37
v4.1-3594f78
v4.1-6bcaabe
v4.1-8386ae0
v4.1-981728f
v4.1-df4a170
v4.1-dfed70f
v4.1-fd5fab3
v4.2-10c19ed
v4.2-3379a1c
v4.2-64f154d
v4.2-9997343
v4.2-a6926d4
v4.2-da58a49
v4.2-f5f9534
v4.2.1-7b10538
v4.2.1-beta-0943b9a
v4.2.1-beta-1446c6b
v4.2.10-beta-1bd9a4b
v4.2.10-beta-d078fba
v4.2.10-d078fba
v4.2.11-97eb073
v4.2.11-beta-caef71c
v4.2.11-beta-f1afa86
v4.2.12-beta-25c25f0
v4.2.12-beta-2bd354b
v4.2.12-beta-3ce0726
v4.2.12-beta-4e235b6
v4.2.12-beta-6eadd6a
v4.2.12-beta-70dd223
v4.2.12-beta-8a28803
v4.2.12-beta-97eb073
v4.2.12-beta-9cfec23
v4.2.12-beta-9dd7fc2
v4.2.12-beta-c380cfb
v4.2.12-beta-ddfdacb
v4.2.12-beta-e9b99e2
v4.2.13-ddfdacb
v4.2.14-56d617b
v4.2.14-beta-56d617b
v4.2.15-328eb4e
v4.2.15-beta-328eb4e
v4.2.15-beta-59ab090
v4.2.15-beta-cb9c418
v4.2.16-95857bc
v4.2.17-b8d4b62
v4.2.17-beta-4a39af5
v4.2.17-beta-59eff6c
v4.2.17-beta-6bb5985
v4.2.17-beta-95857bc
v4.2.17-beta-b8d4b62
v4.2.17-beta-bb1bdb1
v4.2.18-beta-0d98e32
v4.2.18-beta-11a86c5
v4.2.18-beta-1b38d48
v4.2.18-beta-34a5b45
v4.2.18-beta-399ecc9
v4.2.18-beta-540674b
v4.2.18-beta-5816088
v4.2.18-beta-5e23596
v4.2.18-beta-669d4f1
v4.2.18-beta-a404264
v4.2.18-beta-b228019
v4.2.18-beta-bcc4fad
v4.2.18-beta-cb13685
v4.2.18-beta-cb50d47
v4.2.18-beta-d510cbd
v4.2.18-beta-dc80da5
v4.2.18-beta-fcd63f2
v4.2.18-beta-fd775e1
v4.2.18-beta-ff065b5
v4.2.2-d44ae9d
v4.2.3-d488a1e
v4.2.4-6181c4a
v4.2.5-0ab246c
v4.2.6-beta-0ba8b30
v4.2.6-beta-4a29601
v4.2.6-beta-505afd6
v4.2.6-beta-521fc32
v4.2.6-beta-5554edf
v4.2.6-beta-688192a
v4.2.6-beta-77386f2
v4.2.6-beta-9cab2ff
v4.2.6-beta-a77902b
v4.2.6-beta-e3bced6
v4.2.6-beta-e3e33ea
v4.2.6-beta-e3fec11
v4.2.6-beta-e92e21e
v4.2.6-beta-e9d43ea
v4.2.6-beta-ec8db39
v4.2.6-e3bced6
v4.2.7-1c782a1
v4.2.7-beta-1c782a1
v4.2.7-beta-1cc0a77
v4.2.7-beta-268aa55
v4.2.7-beta-65c19c6
v4.2.7-beta-7ad2f7d
v4.2.7-beta-88b2b3a
v4.2.7-beta-b39d99a
v4.2.7-beta-e0e2967
v4.2.8-beta-046a61a
v4.2.8-beta-11ee34c
v4.2.8-beta-14393bb
v4.2.8-beta-1c17230
v4.2.8-beta-23e30c5
v4.2.8-beta-2f491e6
v4.2.8-beta-34142ac
v4.2.8-beta-3440884
v4.2.8-beta-723e90c
v4.2.8-beta-844141b
v4.2.8-beta-8df99b8
v4.2.8-beta-941ba0d
v4.2.8-beta-954bb2a
v4.2.8-beta-96049f8
v4.2.8-beta-9ab4936
v4.2.8-beta-9f81d2d
v4.2.8-beta-aa06e60
v4.2.8-beta-e9ab07b
v4.2.8-beta-f1a2de7
v4.2.8-beta-f51fc8e
v4.2.8-beta-f55f283
v4.2.8-beta-f606b7a
v4.2.8-beta-f84e3d4
v4.2.8-beta-fcbe4ec
v4.2.8-e9ab07b
v4.2.9-1bd9a4b
v4.2.9-beta-0a8cd29
v4.2.9-beta-0c7f3d1
v4.2.9-beta-17cd99f
v4.2.9-beta-217a1fb
v4.2.9-beta-25e1230
v4.2.9-beta-2924fec
v4.2.9-beta-2c78ce1
v4.2.9-beta-3a9e8c7
v4.2.9-beta-43f52c8
v4.2.9-beta-48d9e4b
v4.2.9-beta-52d3a07
v4.2.9-beta-58ad180
v4.2.9-beta-5ffabaf
v4.2.9-beta-690e5fd
v4.2.9-beta-6f2122a
v4.2.9-beta-704d137
v4.2.9-beta-7768ef9
v4.2.9-beta-7d215cd
v4.2.9-beta-88a324e
v4.2.9-beta-8b7f499
v4.2.9-beta-8fcabc9
v4.2.9-beta-ba38640
v4.2.9-beta-c21ad1e
v4.2.9-beta-c9f6efa
v4.2.9-beta-cd8eec6
v4.2.9-beta-db4dee9
v4.2.9-beta-e5bed60
v4.2.9-beta-eed8ad3
v4.2.9-beta-f5efabc
v4.2.9-beta-fe1590d
v5.*
v5.0.1-55e1b25
v5.0.1-beta-2886304
v5.0.1-beta-2988ac7
v5.0.1-beta-3070e48
v5.0.1-beta-55e1b25
v5.0.1-beta-88cd8c1
v5.0.1-beta-8ac14af
v5.0.1-beta-94efede
v5.0.1-beta-aa7d36b
v5.0.1-beta-b406f51
v5.0.1-beta-bdb58cc
v5.0.1-beta-c1cbf74
v5.0.1-beta-c21325f
v5.0.1-beta-c621aac
v5.0.1-beta-c8303f6
v5.0.1-beta-c9010bb
v5.0.1-beta-cfb81ad
v5.0.1-beta-efaff77
v5.0.1-beta-f579cfc
v5.0.10-beta-1ecf73c
v5.0.10-beta-324dedc
v5.0.10-beta-40894f9
v5.0.10-beta-42fc946
v5.0.10-beta-481a53f
v5.0.10-beta-5780b84
v5.0.10-beta-578aebc
v5.0.10-beta-8e0a2e7
v5.0.10-beta-a7227fa
v5.0.10-beta-b4b91e5
v5.0.10-beta-b98d3cd
v5.0.10-beta-c1747fa
v5.0.10-beta-e34820d
v5.0.10-beta-eab3c5d
v5.0.10-beta-f4fba42
v5.0.10-beta-f7a57d6
v5.0.2-4777d0a
v5.0.3-beta-053aa03
v5.0.3-beta-12221d5
v5.0.3-beta-15553e6
v5.0.3-beta-243623e
v5.0.3-beta-3096770
v5.0.3-beta-331cf56
v5.0.3-beta-3a6d0ed
v5.0.3-beta-461181a
v5.0.3-beta-4777d0a
v5.0.3-beta-4aac24c
v5.0.3-beta-59d40fd
v5.0.3-beta-6a92223
v5.0.3-beta-73a4f68
v5.0.3-beta-758469d
v5.0.3-beta-89dfe46
v5.0.3-beta-b19e6a0
v5.0.3-beta-b8ebe86
v5.0.3-beta-ca0cb45
v5.0.3-beta-ca77b7c
v5.0.3-beta-cd6f912
v5.0.3-beta-dd6bc64
v5.0.3-beta-e3ae3ee
v5.0.3-e353aa8
v5.0.4-1f46165
v5.0.4-beta-1f46165
v5.0.4-beta-2441e70
v5.0.4-beta-2ab3798
v5.0.4-beta-3005356
v5.0.4-beta-4343a17
v5.0.4-beta-746c770
v5.0.4-beta-7795456
v5.0.4-beta-7c520a0
v5.0.4-beta-90ffdf2
v5.0.4-beta-9bf3d64
v5.0.4-beta-a993d34
v5.0.4-beta-d203f0e
v5.0.4-beta-e353aa8
v5.0.4-beta-fc9d6f7
v5.0.5-beta-021d859
v5.0.5-beta-2482275
v5.0.5-beta-2a7f718
v5.0.5-beta-3316277
v5.0.5-beta-38f7c2e
v5.0.5-beta-3b9b55d
v5.0.5-beta-3f49a49
v5.0.5-beta-42f1098
v5.0.5-beta-471e377
v5.0.5-beta-4eead5d
v5.0.5-beta-4f6ef83
v5.0.5-beta-5bc5829
v5.0.5-beta-6aca802
v5.0.5-beta-7a4ab7e
v5.0.5-beta-7e2e888
v5.0.5-beta-88d7d25
v5.0.5-beta-890a08d
v5.0.5-beta-8a30ca9
v5.0.5-beta-a782de7
v5.0.5-beta-b5ace27
v5.0.5-beta-b7131a2
v5.0.5-beta-bef6534
v5.0.5-beta-c2f8d0d
v5.0.5-beta-c6cff32
v5.0.5-beta-caaf673
v5.0.5-beta-ccb76b9
v5.0.5-beta-cf705ac
v5.0.5-beta-d1798c4
v5.0.5-beta-ec72fcc
v5.0.5-beta-f28024e
v5.0.5-beta-f5ccbe5
v5.0.5-caaf673
v5.0.6-d6a765c
v5.0.7-506cefb
v5.0.7-beta-13ab01d
v5.0.7-beta-2690d48
v5.0.7-beta-319c8d4
v5.0.7-beta-353a08c
v5.0.7-beta-3606708
v5.0.7-beta-506cefb
v5.0.7-beta-5db2699
v5.0.7-beta-6233b33
v5.0.7-beta-779f01d
v5.0.7-beta-7c45e68
v5.0.7-beta-86ffb08
v5.0.7-beta-8d1de5f
v5.0.7-beta-901b9c4
v5.0.7-beta-9118d3d
v5.0.7-beta-92d038f
v5.0.7-beta-945f571
v5.0.7-beta-99574f3
v5.0.7-beta-b8f20c4
v5.0.7-beta-bced2a8
v5.0.7-beta-d6a765c
v5.0.7-beta-f9cee89
v5.0.8-05b0a45
v5.0.8-beta-05b0a45
v5.0.8-beta-a404e56
v5.0.8-beta-c17e090
v5.0.9-06ab4d1
v5.0.9-beta-06ab4d1
v5.0.9-beta-763cd21

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47133.json"