Executive brief
ClearanceKit is a security tool for macOS that manages file-system access policies to protect sensitive data. A flaw in how it stores its security keys allows a local user with administrative (root) privileges to bypass these protections. An attacker could use this to modify security rules, whitelist malicious software, or disable tamper protections without being detected.
Technical details
ClearanceKit versions prior to 5.0.10 suffer from an incorrect permission assignment (CWE-732) regarding its ECDSA private key stored in the macOS System Keychain. The vulnerability stems from using a two-step creation pattern (SecKeyCreateRandomKey followed by SecItemAdd) where the Access Control List (ACL) attribute (kSecAttrAccess) is silently ignored by the legacy System Keychain for EC keys. Consequently, the key inherits no ACL restrictions, allowing any process with root privileges to access the key and sign arbitrary policy databases. An attacker with local root access can exploit this to inject whitelist rules or disable security features. The issue is resolved in version 5.0.10 by using a single-step creation and persistence call that correctly binds the ACL.
Affected products
- craigjbass ClearanceKit < 5.0.10
Timeline
- 2026-05-17: advisory: GitHub advisory published
- 2026-07-20: disclosed: NVD publication date