CVE-2026-47134 craigjbass CVE debrief

Who should care

macOS system administrators, security teams, and developers using ClearanceKit should assess exposure and update to version 5.0.10 or later to mitigate this vulnerability. Affected operators must review system extension configurations, implement additional access controls, and monitor for suspicious activity. Vulnerability management and security teams should prioritize updates and verify system integrity.

Why it matters

CVE-2026-47134 allows any process running as root to produce valid signatures over arbitrary policy content, enabling the bypass of intended access controls in ClearanceKit prior to version 5.0.10. macOS system administrators and security teams should assess exposure and update to mitigate this vulnerability.

• Elevation of privileges for root-level processes
• Bypass of intended access controls for policy enforcement
• Potential for malicious policy content injection

Technical summary

The ECDSA private key used by ClearanceKit to sign the on-disk policy database is stored in the macOS System Keychain. Due to a bug, the key's access control list (ACL) is not properly enforced, allowing any process running as root to use the key for signing arbitrary policy content. This issue is specific to EC keys and not applicable to generic password items. The vulnerability enables the bypass of intended access controls in ClearanceKit prior to version 5.0.10. The issue is resolved in ClearanceKit version 5.0.10, which properly enforces the ACL for the ECDSA private key.

Defensive priority

High

Recommended defensive actions

• Review and update ClearanceKit to version 5.0.10 or later
• Verify system extension configurations and monitor for suspicious activity
• Implement additional access controls and monitoring for root-level processes
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. A source reference from GitHub also provides additional context. To verify, defenders should review the official advisory and assess exposure in their environments. The issue is resolved in ClearanceKit version 5.0.10. Evidence is limited to public CVE and NVD records, and potentially affected deployments should be confirmed through internal asset tracking and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.