CVE-2026-47134

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-47134
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47134.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-47134
Aliases
  • GHSA-w254-hxm5-3hgh
Published
2026-07-20T21:17:22.539Z
Modified
2026-08-12T03:51:48.353134300Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N CVSS Calculator
Summary
ClearanceKit: Policy signing key in System Keychain has permissive ACL allowing any local-root process to forge signed policy
Details

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. The ECDSA private key used to sign the on-disk policy database (/Library/Application Support/clearancekit/store.db) is stored in the macOS System Keychain. The key was created via the two-step pattern SecKeyCreateRandomKey (in-memory) followed by SecItemAdd(kSecValueRef:, kSecAttrAccess:) (persist). Prior to version 5.0.10, for kSecClassKey items in the legacy System Keychain, kSecAttrAccess passed to SecItemAdd is silently ignored — the persisted key inherits no ACL restriction. The same access builder applied to kSecClassGenericPassword items correctly binds the ACL, making this bug specific to the EC key. The result is that any process running as root can use the key to produce valid signatures over arbitrary policy content. Version 5.0.10 fixes the issue. No known workarounds are available. Disabling the system extension and manually removing the System Keychain item labelled clearancekit policy signing key would prevent the forged-signature path but also disables policy enforcement.

Database specific 
{
    "cwe_ids": [
        "CWE-732"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47134.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/craigjbass/clearancekit

Affected ranges

Type
GIT
Repo
https://github.com/craigjbass/clearancekit
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
afb9006638e4fd8bd1b134b26bb938b5b22d85b4
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.0.10"
        }
    ]
}

Affected versions

v3.*
v3.1-1480877
v3.1-1c065f7
v3.1-2bc8773
v3.1-34107d6
v3.1-56cf8aa
v3.1-781fe68
v3.1-9444cb6
v3.1-962116d
v3.1-9ae9a1e
v3.1-a563b4b
v3.1-b616763
v3.1-bab7abf
v3.1-def8687
v3.1-f48c585
v3.1-f9c7713
v3.2-9bb23fd
v3.3-9bb62a6
v4.*
v4.0-19126ba
v4.0-2ccd30f
v4.0-3f01958
v4.0-5a0de89
v4.0-8fc8884
v4.0-b574aa3
v4.0-c828d5e
v4.0-db67c62
v4.0-e2705e0
v4.0-eca88d7
v4.0-f8c9232
v4.1-16a3e37
v4.1-3594f78
v4.1-6bcaabe
v4.1-8386ae0
v4.1-981728f
v4.1-df4a170
v4.1-dfed70f
v4.1-fd5fab3
v4.2-10c19ed
v4.2-3379a1c
v4.2-64f154d
v4.2-9997343
v4.2-a6926d4
v4.2-da58a49
v4.2-f5f9534
v4.2.1-7b10538
v4.2.1-beta-0943b9a
v4.2.1-beta-1446c6b
v4.2.10-beta-1bd9a4b
v4.2.10-beta-d078fba
v4.2.10-d078fba
v4.2.11-97eb073
v4.2.11-beta-caef71c
v4.2.11-beta-f1afa86
v4.2.12-beta-25c25f0
v4.2.12-beta-2bd354b
v4.2.12-beta-3ce0726
v4.2.12-beta-4e235b6
v4.2.12-beta-6eadd6a
v4.2.12-beta-70dd223
v4.2.12-beta-8a28803
v4.2.12-beta-97eb073
v4.2.12-beta-9cfec23
v4.2.12-beta-9dd7fc2
v4.2.12-beta-c380cfb
v4.2.12-beta-ddfdacb
v4.2.12-beta-e9b99e2
v4.2.13-ddfdacb
v4.2.14-56d617b
v4.2.14-beta-56d617b
v4.2.15-328eb4e
v4.2.15-beta-328eb4e
v4.2.15-beta-59ab090
v4.2.15-beta-cb9c418
v4.2.16-95857bc
v4.2.17-b8d4b62
v4.2.17-beta-4a39af5
v4.2.17-beta-59eff6c
v4.2.17-beta-6bb5985
v4.2.17-beta-95857bc
v4.2.17-beta-b8d4b62
v4.2.17-beta-bb1bdb1
v4.2.18-beta-0d98e32
v4.2.18-beta-11a86c5
v4.2.18-beta-1b38d48
v4.2.18-beta-34a5b45
v4.2.18-beta-399ecc9
v4.2.18-beta-540674b
v4.2.18-beta-5816088
v4.2.18-beta-5e23596
v4.2.18-beta-669d4f1
v4.2.18-beta-a404264
v4.2.18-beta-b228019
v4.2.18-beta-bcc4fad
v4.2.18-beta-cb13685
v4.2.18-beta-cb50d47
v4.2.18-beta-d510cbd
v4.2.18-beta-dc80da5
v4.2.18-beta-fcd63f2
v4.2.18-beta-fd775e1
v4.2.18-beta-ff065b5
v4.2.2-d44ae9d
v4.2.3-d488a1e
v4.2.4-6181c4a
v4.2.5-0ab246c
v4.2.6-beta-0ba8b30
v4.2.6-beta-4a29601
v4.2.6-beta-505afd6
v4.2.6-beta-521fc32
v4.2.6-beta-5554edf
v4.2.6-beta-688192a
v4.2.6-beta-77386f2
v4.2.6-beta-9cab2ff
v4.2.6-beta-a77902b
v4.2.6-beta-e3bced6
v4.2.6-beta-e3e33ea
v4.2.6-beta-e3fec11
v4.2.6-beta-e92e21e
v4.2.6-beta-e9d43ea
v4.2.6-beta-ec8db39
v4.2.6-e3bced6
v4.2.7-1c782a1
v4.2.7-beta-1c782a1
v4.2.7-beta-1cc0a77
v4.2.7-beta-268aa55
v4.2.7-beta-65c19c6
v4.2.7-beta-7ad2f7d
v4.2.7-beta-88b2b3a
v4.2.7-beta-b39d99a
v4.2.7-beta-e0e2967
v4.2.8-beta-046a61a
v4.2.8-beta-11ee34c
v4.2.8-beta-14393bb
v4.2.8-beta-1c17230
v4.2.8-beta-23e30c5
v4.2.8-beta-2f491e6
v4.2.8-beta-34142ac
v4.2.8-beta-3440884
v4.2.8-beta-723e90c
v4.2.8-beta-844141b
v4.2.8-beta-8df99b8
v4.2.8-beta-941ba0d
v4.2.8-beta-954bb2a
v4.2.8-beta-96049f8
v4.2.8-beta-9ab4936
v4.2.8-beta-9f81d2d
v4.2.8-beta-aa06e60
v4.2.8-beta-e9ab07b
v4.2.8-beta-f1a2de7
v4.2.8-beta-f51fc8e
v4.2.8-beta-f55f283
v4.2.8-beta-f606b7a
v4.2.8-beta-f84e3d4
v4.2.8-beta-fcbe4ec
v4.2.8-e9ab07b
v4.2.9-1bd9a4b
v4.2.9-beta-0a8cd29
v4.2.9-beta-0c7f3d1
v4.2.9-beta-17cd99f
v4.2.9-beta-217a1fb
v4.2.9-beta-25e1230
v4.2.9-beta-2924fec
v4.2.9-beta-2c78ce1
v4.2.9-beta-3a9e8c7
v4.2.9-beta-43f52c8
v4.2.9-beta-48d9e4b
v4.2.9-beta-52d3a07
v4.2.9-beta-58ad180
v4.2.9-beta-5ffabaf
v4.2.9-beta-690e5fd
v4.2.9-beta-6f2122a
v4.2.9-beta-704d137
v4.2.9-beta-7768ef9
v4.2.9-beta-7d215cd
v4.2.9-beta-88a324e
v4.2.9-beta-8b7f499
v4.2.9-beta-8fcabc9
v4.2.9-beta-ba38640
v4.2.9-beta-c21ad1e
v4.2.9-beta-c9f6efa
v4.2.9-beta-cd8eec6
v4.2.9-beta-db4dee9
v4.2.9-beta-e5bed60
v4.2.9-beta-eed8ad3
v4.2.9-beta-f5efabc
v4.2.9-beta-fe1590d
v5.*
v5.0.1-55e1b25
v5.0.1-beta-2886304
v5.0.1-beta-2988ac7
v5.0.1-beta-3070e48
v5.0.1-beta-55e1b25
v5.0.1-beta-88cd8c1
v5.0.1-beta-8ac14af
v5.0.1-beta-94efede
v5.0.1-beta-aa7d36b
v5.0.1-beta-b406f51
v5.0.1-beta-bdb58cc
v5.0.1-beta-c1cbf74
v5.0.1-beta-c21325f
v5.0.1-beta-c621aac
v5.0.1-beta-c8303f6
v5.0.1-beta-c9010bb
v5.0.1-beta-cfb81ad
v5.0.1-beta-efaff77
v5.0.1-beta-f579cfc
v5.0.10-beta-1ecf73c
v5.0.10-beta-324dedc
v5.0.10-beta-40894f9
v5.0.10-beta-42fc946
v5.0.10-beta-481a53f
v5.0.10-beta-5780b84
v5.0.10-beta-578aebc
v5.0.10-beta-8e0a2e7
v5.0.10-beta-a7227fa
v5.0.10-beta-b4b91e5
v5.0.10-beta-b98d3cd
v5.0.10-beta-c1747fa
v5.0.10-beta-e34820d
v5.0.10-beta-eab3c5d
v5.0.10-beta-f4fba42
v5.0.10-beta-f7a57d6
v5.0.2-4777d0a
v5.0.3-beta-053aa03
v5.0.3-beta-12221d5
v5.0.3-beta-15553e6
v5.0.3-beta-243623e
v5.0.3-beta-3096770
v5.0.3-beta-331cf56
v5.0.3-beta-3a6d0ed
v5.0.3-beta-461181a
v5.0.3-beta-4777d0a
v5.0.3-beta-4aac24c
v5.0.3-beta-59d40fd
v5.0.3-beta-6a92223
v5.0.3-beta-73a4f68
v5.0.3-beta-758469d
v5.0.3-beta-89dfe46
v5.0.3-beta-b19e6a0
v5.0.3-beta-b8ebe86
v5.0.3-beta-ca0cb45
v5.0.3-beta-ca77b7c
v5.0.3-beta-cd6f912
v5.0.3-beta-dd6bc64
v5.0.3-beta-e3ae3ee
v5.0.3-e353aa8
v5.0.4-1f46165
v5.0.4-beta-1f46165
v5.0.4-beta-2441e70
v5.0.4-beta-2ab3798
v5.0.4-beta-3005356
v5.0.4-beta-4343a17
v5.0.4-beta-746c770
v5.0.4-beta-7795456
v5.0.4-beta-7c520a0
v5.0.4-beta-90ffdf2
v5.0.4-beta-9bf3d64
v5.0.4-beta-a993d34
v5.0.4-beta-d203f0e
v5.0.4-beta-e353aa8
v5.0.4-beta-fc9d6f7
v5.0.5-beta-021d859
v5.0.5-beta-2482275
v5.0.5-beta-2a7f718
v5.0.5-beta-3316277
v5.0.5-beta-38f7c2e
v5.0.5-beta-3b9b55d
v5.0.5-beta-3f49a49
v5.0.5-beta-42f1098
v5.0.5-beta-471e377
v5.0.5-beta-4eead5d
v5.0.5-beta-4f6ef83
v5.0.5-beta-5bc5829
v5.0.5-beta-6aca802
v5.0.5-beta-7a4ab7e
v5.0.5-beta-7e2e888
v5.0.5-beta-88d7d25
v5.0.5-beta-890a08d
v5.0.5-beta-8a30ca9
v5.0.5-beta-a782de7
v5.0.5-beta-b5ace27
v5.0.5-beta-b7131a2
v5.0.5-beta-bef6534
v5.0.5-beta-c2f8d0d
v5.0.5-beta-c6cff32
v5.0.5-beta-caaf673
v5.0.5-beta-ccb76b9
v5.0.5-beta-cf705ac
v5.0.5-beta-d1798c4
v5.0.5-beta-ec72fcc
v5.0.5-beta-f28024e
v5.0.5-beta-f5ccbe5
v5.0.5-caaf673
v5.0.6-d6a765c
v5.0.7-506cefb
v5.0.7-beta-13ab01d
v5.0.7-beta-2690d48
v5.0.7-beta-319c8d4
v5.0.7-beta-353a08c
v5.0.7-beta-3606708
v5.0.7-beta-506cefb
v5.0.7-beta-5db2699
v5.0.7-beta-6233b33
v5.0.7-beta-779f01d
v5.0.7-beta-7c45e68
v5.0.7-beta-86ffb08
v5.0.7-beta-8d1de5f
v5.0.7-beta-901b9c4
v5.0.7-beta-9118d3d
v5.0.7-beta-92d038f
v5.0.7-beta-945f571
v5.0.7-beta-99574f3
v5.0.7-beta-b8f20c4
v5.0.7-beta-bced2a8
v5.0.7-beta-d6a765c
v5.0.7-beta-f9cee89
v5.0.8-05b0a45
v5.0.8-beta-05b0a45
v5.0.8-beta-a404e56
v5.0.8-beta-c17e090
v5.0.9-06ab4d1
v5.0.9-beta-06ab4d1
v5.0.9-beta-763cd21

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47134.json"