CVE-2026-33632: ClearanceKit Auth Bypass Vulnerability

CVE-2026-33632 Overview

CVE-2026-33632 is a Missing Authorization vulnerability affecting ClearanceKit, a macOS utility that intercepts file-system access events and enforces per-process access policies. Prior to version 4.2.4, two critical file operation event types — ES_EVENT_TYPE_AUTH_EXCHANGEDATA and ES_EVENT_TYPE_AUTH_CLONE — were not intercepted by ClearanceKit's opfilter system extension. This gap allows local processes to bypass file access policies entirely, potentially enabling unauthorized data access or modification on protected systems.

Critical Impact

Local attackers with limited privileges can bypass ClearanceKit's file access controls by exploiting unmonitored macOS Endpoint Security event types, potentially compromising data integrity and confidentiality on protected systems.

Affected Products

• ClearanceKit versions prior to 4.2.4
• macOS systems running vulnerable ClearanceKit opfilter system extension

Discovery Timeline

• 2026-03-26 - CVE CVE-2026-33632 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33632

Vulnerability Analysis

This vulnerability stems from incomplete event subscription in ClearanceKit's Endpoint Security (ES) integration. macOS Endpoint Security framework provides a comprehensive set of authorization events that security tools must subscribe to in order to enforce file access policies. ClearanceKit's opfilter system extension was designed to intercept file operations and route them through a policy evaluator, but two important event types were overlooked during implementation.

The ES_EVENT_TYPE_AUTH_EXCHANGEDATA event is triggered when processes attempt to atomically exchange data between two files, a common operation used by applications for safe file updates. The ES_EVENT_TYPE_AUTH_CLONE event is triggered when processes attempt to clone files using copy-on-write semantics. By not subscribing to these events, ClearanceKit allowed local processes to perform these file operations without policy enforcement, effectively creating a bypass mechanism.

Root Cause

The root cause is classified as CWE-862 (Missing Authorization). The ESInboundAdapter.swift component failed to include ES_EVENT_TYPE_AUTH_EXCHANGEDATA and ES_EVENT_TYPE_AUTH_CLONE in its event subscription list. Similarly, the FilterInteractor.swift component lacked corresponding case handlers for exchangedata and clone operations in its event processing logic. This incomplete coverage meant that file operations using these specific macOS APIs could circumvent the access control mechanism entirely.

Attack Vector

The vulnerability requires local access to an affected system. An attacker with low privileges can exploit this flaw by using standard macOS file operations that trigger the unmonitored event types. For example, using file cloning operations via clonefile() system call or data exchange operations would bypass ClearanceKit's policy evaluator. This allows an attacker to read, modify, or manipulate files that should be protected by ClearanceKit's access policies, potentially leading to unauthorized data access, data exfiltration, or integrity compromise.

The following patch demonstrates how the vulnerability was addressed by adding subscriptions to the missing event types:

ESInboundAdapter.swift patch:

             ES_EVENT_TYPE_AUTH_TRUNCATE,
             ES_EVENT_TYPE_AUTH_COPYFILE,
             ES_EVENT_TYPE_AUTH_READDIR,
+            ES_EVENT_TYPE_AUTH_EXCHANGEDATA,
+            ES_EVENT_TYPE_AUTH_CLONE,
             ES_EVENT_TYPE_NOTIFY_FORK,
             ES_EVENT_TYPE_NOTIFY_EXEC,
             ES_EVENT_TYPE_NOTIFY_EXIT,

Source: GitHub Commit Update

FilterInteractor.swift patch:

     case link     = "link"
     case create   = "create"
     case truncate = "truncate"
-    case copyfile = "copyfile"
-    case readdir  = "readdir"
+    case copyfile      = "copyfile"
+    case readdir       = "readdir"
+    case exchangedata  = "exchangedata"
+    case clone         = "clone"
 }
 
 // MARK: - FileAuthEvent

Source: GitHub Commit Update

Detection Methods for CVE-2026-33632

Indicators of Compromise

• Unexpected file cloning operations (clonefile() calls) targeting protected directories
• Unusual exchangedata system calls on files that should be access-controlled
• Policy-protected files modified without corresponding audit events from ClearanceKit
• Processes accessing sensitive files without triggering expected access denials

Detection Strategies

• Monitor macOS unified logs for clonefile and exchangedata system calls on protected paths
• Audit file modification timestamps against ClearanceKit policy evaluation logs to identify gaps
• Implement supplementary file integrity monitoring on critical assets to detect unauthorized changes
• Review system extension status to verify ClearanceKit opfilter is running the patched version

Monitoring Recommendations

• Enable verbose logging in ClearanceKit to capture all file operation events for forensic analysis
• Deploy endpoint detection solutions that monitor macOS Endpoint Security events independently
• Establish baseline metrics for file clone and exchange operations to detect anomalous activity
• Configure alerts for file modifications in protected directories that lack corresponding ClearanceKit policy events

How to Mitigate CVE-2026-33632

Immediate Actions Required

• Upgrade ClearanceKit to version 4.2.4 or later immediately
• Reactivate the opfilter system extension after upgrade to ensure the patched code is loaded
• Audit systems for signs of exploitation during the vulnerable period
• Review access logs for any suspicious file operations involving clone or exchangedata events

Patch Information

The vulnerability is addressed in commit 6181c4a22eccbeca973c77f4bd023eb795c13786, which adds subscriptions to both ES_EVENT_TYPE_AUTH_EXCHANGEDATA and ES_EVENT_TYPE_AUTH_CLONE events and routes them through the existing policy evaluator. Users must upgrade to ClearanceKit version 4.2.4 or later. After upgrading, the system extension must be reactivated to ensure the new event subscriptions take effect. For detailed patch information, refer to the GitHub Security Advisory.

Workarounds

• Implement supplementary file integrity monitoring on critical protected files until patching is complete
• Restrict local user access to minimize the attack surface for low-privilege exploitation
• Use macOS built-in TCC (Transparency, Consent, and Control) as an additional layer of file access control
• Consider disabling ClearanceKit temporarily and relying on alternative access control mechanisms if patching is delayed

# Verify ClearanceKit version and reactivate system extension
# Check installed version
clearancekit --version

# If version is below 4.2.4, upgrade first, then reactivate
systemextensionsctl reset
# Follow ClearanceKit documentation to reactivate the opfilter extension