CVE-2026-33632 ClearanceKit: opfilter policy bypass via exchangedata and clone operations

What is CVE-2026-33632?

CVE-2026-33632 is a high-severity vulnerability in craigjbass clearancekit, published on 26 Mar 2026.

Official description

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 4.2.4, two file operation event types — ES_EVENT_TYPE_AUTH_EXCHANGEDATA and ES_EVENT_TYPE_AUTH_CLONE — were not intercepted by ClearanceKit's opfilter system extension, allowing local processes to bypass file access policies. Commit 6181c4a patches the vulnerability by subscribing to both event types and routing them through the existing policy evaluator. Users must upgrade to v4.2.4 or later and reactivate the system extension.

Weakness: CWE-862

Which versions are affected by CVE-2026-33632?

It affects 1 product.

Products include Craigjbass Clearancekit.

How do I fix CVE-2026-33632?

No fix has been published for CVE-2026-33632 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-33632 being exploited?

There is no known exploitation of CVE-2026-33632 in the wild and no public exploit code.

Other vulnerabilities in craigjbass clearancekit

• CVE-2026-33631 ClearanceKit: opfilter policy bypass via non-open file operations High 8.7
• CVE-2026-40599 ClearanceKit: Ad-hoc signed binaries can spoof Apple process identities in the global allowlist High 8.4
• CVE-2026-40604 Security feature bypass in clearancekit High 8.2
• CVE-2026-34218 ClearanceKit: Managed and user-defined policy rules not enforced between opfilter start and first policy modification Medium 6.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wpxj-vhfp-hhvm.