CVE-2026-40599

HighCVSS 7.1/10Last modified Oct 26, 2026

Description

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.5, ClearanceKit incorrectly treats a process with an empty Team ID and a non-empty Signing ID as an Apple platform binary. This bug allows a malicious software to impersonate an apple process in the global allowlist, and access all protected files. This vulnerability is fixed in 5.0.5.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
craigjbass	clearancekit	< 5.0.5

References

https://github.com/craigjbass/clearancekit/security/advisories/GHSA-w253-42qp-5f2xExploit, Vendor Advisory
https://github.com/craigjbass/clearancekit/security/advisories/GHSA-w253-42qp-5f2xExploit, Vendor Advisory

Timeline

Published: Apr 21, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-40607.5The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'sort' parameter in all versions up to, and including,CVE-2026-406008.1Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.CVE-2026-406017.5Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.CVE-2026-406025.6The Home Assistant Command-line interface (hass-cli) is a command-line tool for Home Assistant. Up to 1.0.0 of home-assitant-cli an unrestri CVE-2026-406036.5Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.CVE-2026-406044.4ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.6, the opfilter Endpoint S CVE-2026-406055.7Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.1, a path traversal vulnerability in th CVE-2026-406064.8mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers and mitmweb is a web-based in CVE-2026-406077.5Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.11.0 through 2.28.1, a Stored XSS vulnerability is caused by in CVE-2026-406085.5Next AI Draw.io is a next.js web application that integrates AI capabilities with draw.io diagrams. Prior to 0.4.15, the embedded HTTP sidec CVE-2026-40617.5The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'map_post_type' parameter in all versions up to, and i CVE-2026-406105.5BentoML is a Python library for building online serving systems optimized for AI apps and model inference. In versions 1.4.38 and prior, the