CVE-2026-40191: ClearanceKit Auth Bypass Vulnerability

CVE-2026-40191 Overview

CVE-2026-40191 is an authorization bypass vulnerability in ClearanceKit, a macOS security framework that intercepts file-system access events and enforces per-process access policies. The vulnerability allows local attackers to circumvent file-access protections by exploiting incomplete path validation in dual-path file operations, enabling unauthorized file placement or replacement within protected directories.

Critical Impact

Local processes can bypass File Access Authorization (FAA) rules and App Jail policies to manipulate files in protected directories, potentially compromising system integrity and security controls.

Affected Products

• ClearanceKit versions prior to 5.0.4-beta-1f46165

Discovery Timeline

• April 10, 2026 - CVE-2026-40191 published to NVD
• April 16, 2026 - Last updated in NVD database

Technical Details for CVE-2026-40191

Vulnerability Analysis

This vulnerability stems from CWE-863 (Incorrect Authorization), where the Endpoint Security event handler in ClearanceKit fails to perform comprehensive path validation during dual-path file operations. The security control only validates the source path against File Access Authorization (FAA) rules and App Jail policies, completely ignoring the destination path. This architectural oversight creates a significant gap in the file access protection mechanism.

The impact is confined to local integrity violations—an attacker with local process execution capabilities can place or replace files within directories that should be protected by ClearanceKit's access control policies. While this requires local access to exploit, it effectively renders the file protection mechanisms ineffective against a determined local adversary.

Root Cause

The root cause lies in the incomplete implementation of path validation logic within ClearanceKit's Endpoint Security event handler. When processing file operations that involve two paths (source and destination), the handler only performs authorization checks on the source path. This design flaw assumes that controlling access to source files is sufficient for security, but this assumption fails when attackers use file operations to target protected destination directories.

The affected file operations include rename, link, copyfile, exchangedata, and clone—all of which involve both a source and destination path. By crafting operations with a permissible source path and a protected destination path, attackers can bypass the access controls entirely.

Attack Vector

An attacker with local process execution capabilities can exploit this vulnerability by performing any dual-path file operation where:

1. The source path passes FAA and App Jail policy checks (or is outside protected scope)
2. The destination path resides within a protected directory

The attacker could use standard macOS system calls or utilities to perform rename, hard link creation, file copying, data exchange, or clone operations. Since only the source path is validated, the operation proceeds even when the destination is within a protected directory, effectively bypassing all file access protections.

For detailed technical information, see the GitHub Security Advisory GHSA-92f3-38m7-579h.

Detection Methods for CVE-2026-40191

Indicators of Compromise

• Unexpected file modifications or new files appearing in directories protected by ClearanceKit policies
• Log entries showing file operations where the source path is outside protected directories but results in changes to protected locations
• Evidence of rename, link, copyfile, exchangedata, or clone operations targeting protected directories from unprotected sources

Detection Strategies

• Monitor file system events for dual-path operations where source and destination paths have different protection statuses
• Implement additional file integrity monitoring on directories protected by ClearanceKit policies
• Review ClearanceKit logs for operations that bypass expected policy enforcement patterns

Monitoring Recommendations

• Enable comprehensive file system auditing on macOS endpoints running affected ClearanceKit versions
• Deploy endpoint detection solutions capable of correlating file operation source and destination paths
• Establish baseline file states in protected directories and alert on unexpected modifications

How to Mitigate CVE-2026-40191

Immediate Actions Required

• Upgrade ClearanceKit to version 5.0.4-beta-1f46165 or later immediately
• Audit protected directories for any unauthorized file modifications that may have occurred prior to patching
• Review and verify the integrity of files in directories protected by FAA rules and App Jail policies

Patch Information

The vulnerability is fixed in ClearanceKit version 5.0.4-beta-1f46165. The patch implements proper destination path validation for all dual-path file operations, ensuring both source and destination paths are checked against FAA rules and App Jail policies.

For download and release details, see the GitHub Release v5.0.4.

Workarounds

• If immediate patching is not possible, implement additional file integrity monitoring solutions on critical protected directories
• Restrict local process execution privileges to reduce the attack surface until the patch can be applied
• Consider supplementing ClearanceKit protection with macOS native file system protections such as SIP and file quarantine attributes