CVE-2026-34218

Katalog CVE

CVSS 5.5 · Medium EPSS 0,15%

Kerentanan Improper Privilege Management pada craigjbass clearancekit. Skor CVSS 3.1 5.5 (Medium) menurut CISA ADP.

Deskripsi (NVD)

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 4.2.14, two related startup defects created a window during which only the single compile-time baseline rule was enforced by opfilter. All managed (MDM-delivered) and user-defined file-access rules were not applied until the user interacted with policies through the GUI, triggering a policy mutation over XPC. This issue has been patched in version 4.2.14.

Rincian

Terbit di NVD

31 Maret 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber CISA ADP
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management

EPSS (30 hari)

0,15% peluang dieksploitasi; lebih tinggi dari 4,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/craigjbass/clearancekit/security/advisories/GHSA-fpmv-5wgw-qhhr exploit · advisory vendor
• https://github.com/craigjbass/clearancekit/commit/56d617b778c571e3c29b803636d9807940992daa patch
• https://github.com/craigjbass/clearancekit/commit/ddfdacb2633681bbd9c2f41dbd536ea039386628 patch