# CVE-2026-34218: craigjbass ClearanceKit improper privilege management in opfilter

Source: https://junglewise.ai/threats/cve-2026-34218-craigjbass-clearancekit-improper-privilege-management-in-opfilter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-31. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-34218 · Severity: medium · CVSS 5.5 · Published 2026-03-31

ClearanceKit, a security tool for macOS that manages file-access permissions, contains a flaw where it fails to apply security policies during system startup. Until a user manually interacts with the application's interface, the software only protects its own internal files, leaving other sensitive data unprotected. This could allow unauthorized programs or users to access, modify, or steal protected files that should have been restricted by corporate or user-defined rules.

Technologies: [Craigjbass ClearanceKit](https://junglewise.ai/threats/technologies/clearancekit). Vendors: [Craigjbass](https://junglewise.ai/threats/vendors/craigjbass).

## Quick answers

**Is CVE-2026-34218 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34218 being exploited in the wild.

**How severe is CVE-2026-34218?** Medium severity, with a CVSS score of 5.5, published 31 March 2026.

**Which products and versions are affected?** craigjbass ClearanceKit < 4.2.14.

**Is there a fix for CVE-2026-34218?** A patch was published on 2026-03-31: Fixes committed in version 4.2.14 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34218 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-34218?** Check whether you run Craigjbass ClearanceKit. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

ClearanceKit (opfilter) contains two startup defects that result in a failure to load the full policy set into the FilterInteractor. First, the initialization calls for applying policies (applyPolicyToFilter, applyAllowlistToFilter, and applyJailRulesToFilter) occurred before the Endpoint Security (ES) client was started; because these functions guard on a nil client, they returned early without updating the interactor. Second, the system failed to issue es_clear_cache after startup, allowing the kernel to serve potentially stale authorization decisions. Consequently, only the hardcoded baseline rule was enforced, while MDM-delivered and user-defined rules remained inactive until an XPC-triggered policy mutation occurred. This allows local processes to bypass intended file-access restrictions and jail constraints. The issue is fixed in version 4.2.14 by reordering startup calls and ensuring cache clears.

## Affected products

- craigjbass ClearanceKit < 4.2.14

## Timeline

- 2026-03-26: advisory: GitHub Security Advisory published
- 2026-03-31: disclosed: CVE published to NVD
- 2026-03-31: patched: Fixes committed in version 4.2.14

## References

- [https://github.com/craigjbass/clearancekit/commit/56d617b778c571e3c29b803636d9807940992daa](https://github.com/craigjbass/clearancekit/commit/56d617b778c571e3c29b803636d9807940992daa)
- [https://github.com/craigjbass/clearancekit/commit/ddfdacb2633681bbd9c2f41dbd536ea039386628](https://github.com/craigjbass/clearancekit/commit/ddfdacb2633681bbd9c2f41dbd536ea039386628)
- [https://github.com/craigjbass/clearancekit/security/advisories/GHSA-fpmv-5wgw-qhhr](https://github.com/craigjbass/clearancekit/security/advisories/GHSA-fpmv-5wgw-qhhr)

## Related threats

- [craigjbass ClearanceKit incorrect ACL on policy signing key in System Keychain](https://junglewise.ai/threats/cve-2026-47134-craigjbass-clearancekit-incorrect-acl-on-policy-signing-key-in)
- [ClearanceKit policy replay vulnerability in SQLite store](https://junglewise.ai/threats/cve-2026-47133-clearancekit-policy-replay-vulnerability-in-sqlite-store)
- [ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.6…](https://junglewise.ai/threats/cve-2026-40604-clearancekit-intercepts-file-system-access-events-on-macos-and)
- [ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.5…](https://junglewise.ai/threats/cve-2026-40599-clearancekit-intercepts-file-system-access-events-on-macos-and)