Vulnerability Description
ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 5.0.10, each table in the on-disk SQLite policy store (`/Library/Application Support/clearancekit/store.db`) is verified using an ECDSA signature stored in the `data_signatures` table. The signed payload contains only the canonical row content, with no version counter or freshness binding. An attacker who can write `store.db` and the matching `data_signatures` row — feasible during the opfilter-update window when the Endpoint Security filter is offline, or via offline-boot / decrypted-backup scenarios — can substitute a previously-captured legitimately-signed snapshot. opfilter accepts the older snapshot as fully valid on next boot because the existing signatures still verify. Version 5.0.10 patches the issue.
Related Weaknesses (CWE)
References
FAQ
What is CVE-2026-47133?
CVE-2026-47133 is a documented vulnerability. ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 5.0.10, each table in the on-disk SQLite policy store (`/Library/Application Suppo...
How severe is CVE-2026-47133?
CVSS scoring is not yet available for CVE-2026-47133. Check NVD for updates.
Is there a patch for CVE-2026-47133?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.