Medium
ClearanceKit's signed policy tables lack monotonic counter, allowing replay of older legitimately-signed snapshots
Type: advisorySources: OSV
ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 5.0.10, each table in the on-disk SQLite policy store (`/Library/Application Support/clearancekit/store.db`) is verified using an ECDSA signature stored in the `data_signatures` table. The signed payload contains only the canonical row content, with no version counter or freshness binding. An attacker who can write `store.db` and the matching `data_signatures` row — feasible during the opfilter-update window when the Endpoint Security filter is offline, or via offline-boot / decrypted-backup scenarios — can substitute a previously-captured legitimately-signed snapshot. opfilter accepts the older snapshot as fully valid on next boot because the existing signatures still verify. Version 5.0.10 patches the issue.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-47133
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 22:51 UTC · Revision 1
Source evidence
ClearanceKit's signed policy tables lack monotonic counter, allowing replay of older legitimately-signed snapshots
core-osv · Original sourcePublished 20 Jul 2026, 21:12 UTC
ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 5.0.10, each table in the on-disk SQLite policy store (`/Library/Application Support/clearancekit/store.db`) is verified using an ECDSA signature stored in the `data_signatures` table. The signed payload contains only the canonical row content, with no version counter or freshness binding. An attacker who can write `store.db` and the matching `data_signatures` row — feasible during the opfilter-update window when the Endpoint Security filter is offline, or via offline-boot / decrypted-backup scenarios — can substitute a previously-captured legitimately-signed snapshot. opfilter accepts the older snapshot as fully valid on next boot because the existing signatures still verify. Version 5.0.10 patches the issue.
osv:CVE-2026-47133
Complete source record
{
"id": "2a1e1d6fd07241b60056ab0967bca0d378d1e039317b2eb9fc0b4f7d74d44f24",
"url": "https://osv.dev/vulnerability/CVE-2026-47133",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "ClearanceKit's signed policy tables lack monotonic counter, allowing replay of older legitimately-signed snapshots",
"summary": "ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 5.0.10, each table in the on-disk SQLite policy store (`/Library/Application Support/clearancekit/store.db`) is verified using an ECDSA signature stored in the `data_signatures` table. The signed payload contains only the canonical row content, with no version counter or freshness binding. An attacker who can write `store.db` and the matching `data_signatures` row — feasible during the opfilter-update window when the Endpoint Security filter is offline, or via offline-boot / decrypted-backup scenarios — can substitute a previously-captured legitimately-signed snapshot. opfilter accepts the older snapshot as fully valid on next boot because the existing signatures still verify. Version 5.0.10 patches the issue.",
"evidence": "osv:CVE-2026-47133",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-47133",
"aliases": [
"CVE-2026-47133",
"GHSA-9hx3-5wp9-2qqg"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/craigjbass/clearancekit",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "afb9006638e4fd8bd1b134b26bb938b5b22d85b4"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "5.0.10"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"introduced": "0"
},
{
"fixed": "5.0.10"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"v5.0.10-beta-481a53f",
"v5.0.10-beta-b4b91e5",
"v5.0.10-beta-5780b84",
"v5.0.10-beta-8e0a2e7",
"v5.0.10-beta-40894f9",
"v5.0.10-beta-f4fba42",
"v5.0.10-beta-1ecf73c",
"v5.0.10-beta-e34820d",
"v5.0.10-beta-578aebc",
"v5.0.10-beta-b98d3cd",
"v5.0.10-beta-324dedc",
"v5.0.10-beta-a7227fa",
"v5.0.10-beta-f7a57d6",
"v5.0.10-beta-42fc946",
"v5.0.10-beta-c1747fa",
"v5.0.10-beta-eab3c5d",
"v5.0.9-beta-06ab4d1",
"v5.0.9-06ab4d1",
"v5.0.9-beta-763cd21",
"v5.0.8-beta-05b0a45",
"v5.0.8-05b0a45",
"v5.0.8-beta-c17e090",
"v5.0.8-beta-a404e56",
"v5.0.7-beta-506cefb",
"v5.0.7-506cefb",
"v5.0.7-beta-901b9c4",
"v5.0.7-beta-2690d48",
"v5.0.7-beta-9118d3d",
"v5.0.7-beta-13ab01d",
"v5.0.7-beta-7c45e68",
"v5.0.7-beta-bced2a8",
"v5.0.7-beta-8d1de5f",
"v5.0.7-beta-86ffb08",
"v5.0.7-beta-f9cee89",
"v5.0.7-beta-3606708",
"v5.0.7-beta-92d038f",
"v5.0.7-beta-353a08c",
"v5.0.7-beta-779f01d",
"v5.0.7-beta-99574f3",
"v5.0.7-beta-945f571",
"v5.0.7-beta-b8f20c4",
"v5.0.7-beta-319c8d4",
"v5.0.7-beta-6233b33",
"v5.0.7-beta-5db2699",
"v5.0.7-beta-d6a765c",
"v5.0.6-d6a765c",
"v5.0.5-caaf673",
"v5.0.5-beta-caaf673",
"v5.0.5-beta-2a7f718",
"v5.0.5-beta-bef6534",
"v5.0.5-beta-c2f8d0d",
"v5.0.5-beta-3f49a49",
"v5.0.5-beta-ec72fcc",
"v5.0.5-beta-3b9b55d",
"v5.0.5-beta-d1798c4",
"v5.0.5-beta-2482275",
"v5.0.5-beta-f5ccbe5",
"v5.0.5-beta-5bc5829",
"v5.0.5-beta-021d859",
"v5.0.5-beta-c6cff32",
"v5.0.5-beta-a782de7",
"v5.0.5-beta-4f6ef83",
"v5.0.5-beta-4eead5d",
"v5.0.5-beta-f28024e",
"v5.0.5-beta-38f7c2e",
"v5.0.5-beta-890a08d",
"v5.0.5-beta-cf705ac",
"v5.0.5-beta-b5ace27",
"v5.0.5-beta-b7131a2",
"v5.0.5-beta-7a4ab7e",
"v5.0.5-beta-7e2e888",
"v5.0.5-beta-8a30ca9",
"v5.0.5-beta-3316277",
"v5.0.5-beta-88d7d25",
"v5.0.5-beta-471e377",
"v5.0.5-beta-42f1098",
"v5.0.5-beta-ccb76b9",
"v5.0.5-beta-6aca802",
"v5.0.4-beta-1f46165",
"v5.0.4-1f46165",
"v5.0.4-beta-a993d34",
"v5.0.4-beta-90ffdf2",
"v5.0.4-beta-7c520a0",
"v5.0.4-beta-7795456",
"v5.0.4-beta-fc9d6f7",
"v5.0.4-beta-746c770",
"v5.0.4-beta-2ab3798",
"v5.0.4-beta-4343a17",
"v5.0.4-beta-3005356",
"v5.0.4-beta-d203f0e",
"v5.0.4-beta-9bf3d64",
"v5.0.4-beta-e353aa8",
"v5.0.4-beta-2441e70",
"v5.0.3-e353aa8",
"v5.0.3-beta-cd6f912",
"v5.0.3-beta-3a6d0ed",
"v5.0.3-beta-b8ebe86",
"v5.0.3-beta-461181a",
"v5.0.3-beta-053aa03",
"v5.0.3-beta-ca0cb45",
"v5.0.3-beta-dd6bc64",
"v5.0.3-beta-15553e6",
"v5.0.3-beta-89dfe46",
"v5.0.3-beta-73a4f68",
"v5.0.3-beta-4aac24c",
"v5.0.3-beta-e3ae3ee",
"v5.0.3-beta-6a92223",
"v5.0.3-beta-243623e",
"v5.0.3-beta-758469d",
"v5.0.3-beta-b19e6a0",
"v5.0.3-beta-331cf56",
"v5.0.3-beta-ca77b7c",
"v5.0.3-beta-12221d5",
"v5.0.3-beta-3096770",
"v5.0.3-beta-59d40fd",
"v5.0.3-beta-4777d0a",
"v5.0.2-4777d0a",
"v5.0.1-beta-55e1b25",
"v5.0.1-55e1b25",
"v5.0.1-beta-3070e48",
"v5.0.1-beta-c1cbf74",
"v5.0.1-beta-c8303f6",
"v5.0.1-beta-cfb81ad",
"v5.0.1-beta-aa7d36b",
"v5.0.1-beta-88cd8c1",
"v5.0.1-beta-c9010bb",
"v5.0.1-beta-94efede",
"v5.0.1-beta-f579cfc",
"v5.0.1-beta-bdb58cc",
"v5.0.1-beta-c621aac",
"v5.0.1-beta-2988ac7",
"v5.0.1-beta-efaff77",
"v5.0.1-beta-2886304",
"v5.0.1-beta-b406f51",
"v5.0.1-beta-8ac14af",
"v5.0.1-beta-c21325f",
"v4.2.18-beta-dc80da5",
"v4.2.18-beta-a404264",
"v4.2.18-beta-5e23596",
"v4.2.18-beta-bcc4fad",
"v4.2.18-beta-540674b",
"v4.2.18-beta-fd775e1",
"v4.2.18-beta-1b38d48",
"v4.2.18-beta-cb50d47",
"v4.2.18-beta-fcd63f2",
"v4.2.18-beta-669d4f1",
"v4.2.18-beta-0d98e32",
"v4.2.18-beta-34a5b45",
"v4.2.18-beta-ff065b5",
"v4.2.18-beta-11a86c5",
"v4.2.18-beta-d510cbd",
"v4.2.18-beta-b228019",
"v4.2.18-beta-cb13685",
"v4.2.18-beta-399ecc9",
"v4.2.18-beta-5816088",
"v4.2.17-beta-b8d4b62",
"v4.2.17-b8d4b62",
"v4.2.17-beta-bb1bdb1",
"v4.2.17-beta-4a39af5",
"v4.2.17-beta-59eff6c",
"v4.2.17-beta-6bb5985",
"v4.2.17-beta-95857bc",
"v4.2.16-95857bc",
"v4.2.15-beta-328eb4e",
"v4.2.15-328eb4e",
"v4.2.15-beta-59ab090",
"v4.2.15-beta-cb9c418",
"v4.2.14-beta-56d617b",
"v4.2.14-56d617b",
"v4.2.13-ddfdacb",
"v4.2.12-beta-ddfdacb",
"v4.2.12-beta-70dd223",
"v4.2.12-beta-2bd354b",
"v4.2.12-beta-3ce0726",
"v4.2.12-beta-4e235b6",
"v4.2.12-beta-6eadd6a",
"v4.2.12-beta-8a28803",
"v4.2.12-beta-9cfec23",
"v4.2.12-beta-9dd7fc2",
"v4.2.12-beta-25c25f0",
"v4.2.12-beta-e9b99e2",
"v4.2.12-beta-c380cfb",
"v4.2.12-beta-97eb073",
"v4.2.11-97eb073",
"v4.2.11-beta-f1afa86",
"v4.2.11-beta-caef71c",
"v4.2.10-d078fba",
"v4.2.10-beta-d078fba",
"v4.2.9-1bd9a4b",
"v4.2.10-beta-1bd9a4b",
"v4.2.9-beta-7768ef9",
"v4.2.9-beta-17cd99f",
"v4.2.9-beta-eed8ad3",
"v4.2.9-beta-8fcabc9",
"v4.2.9-beta-43f52c8",
"v4.2.9-beta-48d9e4b",
"v4.2.9-beta-fe1590d",
"v4.2.9-beta-db4dee9",
"v4.2.9-beta-58ad180",
"v4.2.9-beta-ba38640",
"v4.2.9-beta-0a8cd29",
"v4.2.9-beta-5ffabaf",
"v4.2.9-beta-8b7f499",
"v4.2.9-beta-217a1fb",
"v4.2.9-beta-3a9e8c7",
"v4.2.9-beta-c21ad1e",
"v4.2.9-beta-2c78ce1",
"v4.2.9-beta-cd8eec6",
"v4.2.9-beta-690e5fd",
"v4.2.9-beta-e5bed60",
"v4.2.9-beta-c9f6efa",
"v4.2.9-beta-0c7f3d1",
"v4.2.9-beta-88a324e",
"v4.2.9-beta-52d3a07",
"v4.2.9-beta-6f2122a",
"v4.2.9-beta-704d137",
"v4.2.9-beta-25e1230",
"v4.2.9-beta-7d215cd",
"v4.2.9-beta-2924fec",
"v4.2.9-beta-f5efabc",
"v4.2.8-e9ab07b",
"v4.2.8-beta-e9ab07b",
"v4.2.8-beta-954bb2a",
"v4.2.8-beta-f51fc8e",
"v4.2.8-beta-fcbe4ec",
"v4.2.8-beta-f606b7a",
"v4.2.8-beta-1c17230",
"v4.2.8-beta-23e30c5",
"v4.2.8-beta-9ab4936",
"v4.2.8-beta-723e90c",
"v4.2.8-beta-046a61a",
"v4.2.8-beta-f84e3d4",
"v4.2.8-beta-34142ac",
"v4.2.8-beta-2f491e6",
"v4.2.8-beta-3440884",
"v4.2.8-beta-8df99b8",
"v4.2.8-beta-941ba0d",
"v4.2.8-beta-11ee34c",
"v4.2.8-beta-f55f283",
"v4.2.8-beta-f1a2de7",
"v4.2.8-beta-aa06e60",
"v4.2.8-beta-14393bb",
"v4.2.8-beta-844141b",
"v4.2.8-beta-9f81d2d",
"v4.2.8-beta-96049f8",
"v4.2.7-beta-1c782a1",
"v4.2.7-1c782a1",
"v4.2.7-beta-1cc0a77",
"v4.2.7-beta-88b2b3a",
"v4.2.7-beta-b39d99a",
"v4.2.7-beta-7ad2f7d",
"v4.2.7-beta-268aa55",
"v4.2.7-beta-65c19c6",
"v4.2.7-beta-e0e2967",
"v4.2.6-e3bced6",
"v4.2.6-beta-e9d43ea",
"v4.2.6-beta-e3bced6",
"v4.2.6-beta-5554edf",
"v4.2.6-beta-e3fec11",
"v4.2.6-beta-77386f2",
"v4.2.6-beta-4a29601",
"v4.2.6-beta-e92e21e",
"v4.2.6-beta-688192a",
"v4.2.6-beta-9cab2ff",
"v4.2.6-beta-e3e33ea",
"v4.2.6-beta-0ba8b30",
"v4.2.6-beta-521fc32",
"v4.2.6-beta-ec8db39",
"v4.2.6-beta-a77902b",
"v4.2.1-beta-0943b9a",
"v4.2.1-beta-1446c6b",
"v4.2.6-beta-505afd6",
"v4.2.5-0ab246c",
"v4.2.4-6181c4a",
"v4.2.3-d488a1e",
"v4.2.2-d44ae9d",
"v4.2.1-7b10538",
"v4.2-f5f9534",
"v4.2-9997343",
"v4.2-64f154d",
"v4.2-3379a1c",
"v4.2-a6926d4",
"v4.2-10c19ed",
"v4.2-da58a49",
"v4.1-dfed70f",
"v4.1-8386ae0",
"v4.1-df4a170",
"v4.1-16a3e37",
"v4.1-6bcaabe",
"v4.1-fd5fab3",
"v4.1-3594f78",
"v4.1-981728f",
"v4.0-e2705e0",
"v4.0-2ccd30f",
"v4.0-b574aa3",
"v4.0-eca88d7",
"v4.0-3f01958",
"v4.0-db67c62",
"v4.0-5a0de89",
"v4.0-f8c9232",
"v4.0-c828d5e",
"v4.0-19126ba",
"v4.0-8fc8884",
"v3.3-9bb62a6",
"v3.2-9bb23fd",
"v3.1-34107d6",
"v3.1-9444cb6",
"v3.1-9ae9a1e",
"v3.1-1c065f7",
"v3.1-b616763",
"v3.1-56cf8aa",
"v3.1-bab7abf",
"v3.1-a563b4b",
"v3.1-2bc8773",
"v3.1-f48c585",
"v3.1-f9c7713",
"v3.1-def8687",
"v3.1-1480877",
"v3.1-962116d",
"v3.1-781fe68"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47133.json"
}
}
],
"modified": "2026-10-28T02:30:40.027699366Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47133.json",
"https://github.com/craigjbass/clearancekit/security/advisories/GHSA-9hx3-5wp9-2qqg",
"https://nvd.nist.gov/vuln/detail/CVE-2026-47133"
],
"provider_metadata": {
"cwe_ids": [
"CWE-294"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47133.json"
}
},
"related_cves": [
{
"value": "CVE-2026-47133",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 507712,
"published_at": "2026-07-20T21:12:26.245+00:00"
}