Vulnerability · Published Apr 21, 2026 · Assigned by GitHub_M

CVE-2026-40599ClearanceKit: Ad-hoc signed binaries can spoof Apple process identities in the global allowlist

High 8.4

In plain English

A high-severity incorrect authorization in clearancekit from craigjbass. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 4.0)8.4High

Exploit odds (30 days)0.1%top 97.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.5, ClearanceKit incorrectly treats a process with an empty Team ID and a non-empty Signing ID as an Apple platform binary. This bug allows a malicious software to impersonate an apple process in the global allowlist, and access all protected files. This vulnerability is fixed in 5.0.5.

Affected products (as reported)

Vendor	Product	Versions
craigjbass	clearancekit	< 5.0.5

Weakness: CWE-863 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/craigjbass/clearancekit/security/advisories/GHSA-w253-42qp-5f2x x_refsource_CONFIRM