CVE-2026-47133 Overview
CVE-2026-47133 affects ClearanceKit, a macOS Endpoint Security extension that intercepts file-system access events and enforces per-process access policies. The vulnerability is an insufficient verification of data authenticity issue [CWE-294] in the on-disk SQLite policy store located at /Library/Application Support/clearancekit/store.db. Signed policy rows lack a version counter or freshness binding, enabling an attacker with write access to substitute an older, legitimately signed snapshot. The opfilter component accepts the replayed snapshot on next boot because existing Elliptic Curve Digital Signature Algorithm (ECDSA) signatures still validate. Version 5.0.10 patches the flaw.
Critical Impact
An attacker who can write the policy store during an update window, offline boot, or from a decrypted backup can roll back access-control policies to a previous state, weakening file-system enforcement without triggering signature verification failures.
Affected Products
- ClearanceKit versions prior to 5.0.10 (macOS Endpoint Security extension)
- The opfilter policy enforcement component
- The data_signatures table within store.db
Discovery Timeline
- 2026-07-20 - CVE-2026-47133 published to National Vulnerability Database (NVD)
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-47133
Vulnerability Analysis
ClearanceKit persists per-process file-system access policies in a SQLite database at /Library/Application Support/clearancekit/store.db. Each table in that store is protected by an ECDSA signature stored in the data_signatures table. The signature covers the canonical row content of each table.
The signed payload does not incorporate a monotonic version counter, timestamp, or other freshness indicator. Because signatures remain valid across time, any previously observed (store.db, data_signatures) pair remains cryptographically acceptable to the enforcement engine. This is a classic signature replay condition tracked under [CWE-294].
On next boot, opfilter loads the substituted database, validates each signature successfully, and applies the older policy set as authoritative. Enforcement continues with the attacker-chosen policy view.
Root Cause
The root cause is missing freshness binding in the signed payload. Cryptographic authenticity is verified, but authenticity alone does not prove that the payload is the current version. Without a rollback counter bound to a trusted, tamper-resistant location, valid historical snapshots are indistinguishable from the current state.
Attack Vector
Exploitation requires local write access to the policy store. The advisory identifies three practical windows:
- The opfilter update window, during which the Endpoint Security filter is briefly offline and file protection on store.db is relaxed.
- Offline-boot scenarios where the macOS volume can be mounted from a recovery or external environment.
- Decrypted backup access, allowing an attacker to lift a previously signed store.db and data_signatures pair and restage them.
The attacker does not need a signing key. They only need a captured, legitimately signed prior snapshot and the ability to write both tables atomically before opfilter re-initializes.
Detection Methods for CVE-2026-47133
Indicators of Compromise
- Modifications to /Library/Application Support/clearancekit/store.db or the data_signatures table outside of a documented ClearanceKit update event.
- File modification timestamps on store.db that predate the currently installed ClearanceKit version.
- Unexpected reboots or Endpoint Security extension restarts followed by observably relaxed file-system enforcement.
- Presence of external boot media, Target Disk Mode sessions, or FileVault unlock events preceding policy changes.
Detection Strategies
- Maintain an out-of-band hash and version manifest of store.db after each authorized policy change, and alert on any drift where the on-disk hash matches a known older manifest entry.
- Monitor Endpoint Security extension lifecycle events for filter-offline windows that coincide with writes to the ClearanceKit application support directory.
- Correlate opfilter initialization logs at boot with the policy set version currently in effect to identify unexplained regressions.
Monitoring Recommendations
- Ship macOS Unified Log entries related to com.apple.endpointsecurity and clearancekit to a centralized log platform for retention and analysis.
- Alert on any process other than the signed ClearanceKit installer or updater writing to /Library/Application Support/clearancekit/.
- Track FileVault unlock and recovery-mode boot events on managed macOS endpoints.
How to Mitigate CVE-2026-47133
Immediate Actions Required
- Upgrade ClearanceKit to version 5.0.10 or later on all managed macOS endpoints.
- Audit /Library/Application Support/clearancekit/store.db for unexpected content or timestamps predating the currently installed policy set.
- Restrict physical and recovery-mode access to endpoints that enforce sensitive ClearanceKit policies.
- Ensure FileVault is enabled to raise the cost of offline-boot substitution attacks.
Patch Information
Version 5.0.10 of ClearanceKit remediates the vulnerability. Refer to the GitHub Security Advisory GHSA-9hx3-5wp9-2qqg for release details and upgrade guidance.
Workarounds
- Enable FileVault full-disk encryption to prevent offline mounting of the system volume by unauthorized parties.
- Limit administrative (root) access on macOS endpoints, since exploitation requires high-privilege local write access.
- Store an off-host cryptographic hash of the current signed store.db after each policy change and periodically compare it against the on-disk copy to detect rollback.
- Minimize the ClearanceKit update window by scheduling updates during monitored maintenance periods with heightened file-integrity alerting.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
