CVE-2026-40599 ClearanceKit: Ad-hoc signed binaries can spoof Apple process identities in the global allowlist

High 8.4 Published 21 Apr 2026 Updated 21 Apr 2026

Malicious software can spoof Apple process identities to bypass file access restrictions and read protected files on macOS systems using ClearanceKit.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-40599?

CVE-2026-40599 is a high-severity authentication bypass vulnerability in craigjbass clearancekit, published on 21 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.5, ClearanceKit incorrectly treats a process with an empty Team ID and a non-empty Signing ID as an Apple platform binary. This bug allows a malicious software to impersonate an apple process in the global allowlist, and access all protected files. This vulnerability is fixed in 5.0.5.

Weakness: CWE-863

Which versions are affected by CVE-2026-40599?

It affects 1 product.

Products include Craigjbass Clearancekit.

How do I fix CVE-2026-40599?

No fix has been published for CVE-2026-40599 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-40599 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40599 exists.

Sources

Also known as GHSA-w253-42qp-5f2x.