CVE-2026-47133— Craig J. Bass ClearanceKit 授权问题漏洞

ClearanceKit's signed policy tables lack monotonic counter, allowing replay of older legitimately-signed snapshots

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 5.0.10, each table in the on-disk SQLite policy store (`/Library/Application Support/clearancekit/store.db`) is verified using an ECDSA signature stored in the `data_signatures` table. The signed payload contains only the canonical row content, with no version counter or freshness binding. An attacker who can write `store.db` and the matching `data_signatures` row — feasible during the opfilter-update window when the Endpoint Security filter is offline, or via offline-boot / decrypted-backup scenarios — can substitute a previously-captured legitimately-signed snapshot. opfilter accepts the older snapshot as fully valid on next boot because the existing signatures still verify. Version 5.0.10 patches the issue.

CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N

使用捕获-重放进行的认证绕过

Craig J. Bass ClearanceKit 授权问题漏洞

Craig J. Bass ClearanceKit是Craig J. Bass个人开发者开源的一个macOS文件系统访问控制工具。 Craig J. Bass ClearanceKit 5.0.10之前版本存在授权问题漏洞，该漏洞源于SQLite策略库存储中签名验证缺少版本计数器或新鲜度绑定，可能导致攻击者替换已捕获的合法签名快照。

N/A

N/A