CVE-2026-40191 craigjbass CVE debrief

Who should care

macOS system administrators and security teams using ClearanceKit for file access control should assess exposure and apply the patch. They should also review file access authorization rules and App Jail policies for proper configuration, and monitor system logs for suspicious file operations that could indicate attempted bypasses. Additionally, they should verify whether affected product deployments exist in managed environments and assign an owner for

Why it matters

CVE-2026-40191 in ClearanceKit allows local processes to bypass file-access protection on macOS systems. macOS system administrators and security teams should verify exposure, assess configurations, and apply the patch. The vulnerability highlights the need for rigorous access control verification in security software.

• Local privilege escalation through bypassing security controls.
• Potential data integrity issues if protected files are accessed or modified.
• Need for verification of current ClearanceKit version and configuration.
• Possible impact on incident response due to evasion of monitoring.

Technical summary

ClearanceKit, a macOS file-system access event interceptor, had a vulnerability where its Endpoint Security event handler only checked the source path of dual-path file operations against File Access Authorization (FAA) rules and App Jail policies, ignoring the destination path. This allowed local processes to bypass file-access protection using operations like rename, link, copyfile, exchangedata, or clone to place or replace files in protected directories.

Defensive priority

Medium priority for macOS systems using ClearanceKit versions prior to 5.0.4-beta-1f46165

Recommended defensive actions

• Verify and apply the patch (version 5.0.4-beta-1f46165) for ClearanceKit on affected macOS systems.
• Review file access authorization rules and App Jail policies for proper configuration.
• Monitor system logs for suspicious file operations that could indicate attempted bypasses.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• whoShouldCare

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and its fix. Vendor information is limited, but source references include GitHub release and advisory links. The vulnerability was publicly disclosed on 2026-04-10 and has not been modified since then. There are no known exploits or reports of the vulnerability being used in attacks. The vendor has provided a patch for the vulnerability, which is included in version 5.0.4-beta-1f46165 of ClearanceKit.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.