CVE-2026-40604 Security feature bypass in clearancekit

High 8.2 Published 21 Apr 2026 Updated 21 Apr 2026

A root process can suspend the ClearanceKit macOS extension, causing file-access policies to fail open and allowing unauthorized file access.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-40604?

CVE-2026-40604 is a high-severity vulnerability in craigjbass clearancekit, published on 21 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.6, the opfilter Endpoint Security system extension (bundle ID uk.craigbass.clearancekit.opfilter) can be suspended with SIGSTOP or kill -STOP, or killed with SIGKILL/SIGTERM, by any process running as root. While the extension is suspended, all AUTH Endpoint Security events time out and default to allow, silently disabling ClearanceKit's file-access policy enforcement for the duration of the suspension. This vulnerability is fixed in 5.0.6.

Weakness: CWE-693

Which versions are affected by CVE-2026-40604?

It affects 1 product.

Products include Craigjbass Clearancekit.

How do I fix CVE-2026-40604?

No fix has been published for CVE-2026-40604 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-40604 being exploited?

There is no known exploitation of CVE-2026-40604 in the wild and no public exploit code.

Sources

Also known as GHSA-5r9w-9fg6-266q.