Executive brief
ClearanceKit, a security tool for macOS that manages file-access permissions, contains a flaw where it fails to apply security policies during system startup. Until a user manually interacts with the application's interface, the software only protects its own internal files, leaving other sensitive data unprotected. This could allow unauthorized programs or users to access, modify, or steal protected files that should have been restricted by corporate or user-defined rules.
Technical details
ClearanceKit (opfilter) contains two startup defects that result in a failure to load the full policy set into the FilterInteractor. First, the initialization calls for applying policies (applyPolicyToFilter, applyAllowlistToFilter, and applyJailRulesToFilter) occurred before the Endpoint Security (ES) client was started; because these functions guard on a nil client, they returned early without updating the interactor. Second, the system failed to issue es_clear_cache after startup, allowing the kernel to serve potentially stale authorization decisions. Consequently, only the hardcoded baseline rule was enforced, while MDM-delivered and user-defined rules remained inactive until an XPC-triggered policy mutation occurred. This allows local processes to bypass intended file-access restrictions and jail constraints. The issue is fixed in version 4.2.14 by reordering startup calls and ensuring cache clears.
Affected products
- craigjbass ClearanceKit < 4.2.14
Timeline
- 2026-03-26: advisory: GitHub Security Advisory published
- 2026-03-31: disclosed: CVE published to NVD
- 2026-03-31: patched: Fixes committed in version 4.2.14