Skip to content
Heist/ feed
Back to feed
Medium

ClearanceKit has a policy bypass via dual-path Endpoint Security events checking only source path

Type: advisorySources: OSV

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.4-beta-1f46165, ClearanceKit's Endpoint Security event handler only checked the source path of dual-path file operations against File Access Authorization (FAA) rules and App Jail policies. The destination path was ignored entirely. This allowed any local process to bypass file-access protection by using rename, link, copyfile, exchangedata, or clone operations to place or replace files inside protected directories. This vulnerability is fixed in 5.0.4-beta-1f46165.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-40191
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 07:48 UTC · Revision 1

Source evidence

ClearanceKit has a policy bypass via dual-path Endpoint Security events checking only source path

core-osv · Original source

Published 10 Apr 2026, 20:19 UTC

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.4-beta-1f46165, ClearanceKit's Endpoint Security event handler only checked the source path of dual-path file operations against File Access Authorization (FAA) rules and App Jail policies. The destination path was ignored entirely. This allowed any local process to bypass file-access protection by using rename, link, copyfile, exchangedata, or clone operations to place or replace files inside protected directories. This vulnerability is fixed in 5.0.4-beta-1f46165.

osv:CVE-2026-40191
Complete source record
{
  "id": "5d4ee16249db1946195ea23e89f95dfadebaef52c01e8f88cffc2d741bdadcb8",
  "url": "https://osv.dev/vulnerability/CVE-2026-40191",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "ClearanceKit has a policy bypass via dual-path Endpoint Security events checking only source path",
    "summary": "ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.4-beta-1f46165, ClearanceKit's Endpoint Security event handler only checked the source path of dual-path file operations against File Access Authorization (FAA) rules and App Jail policies. The destination path was ignored entirely. This allowed any local process to bypass file-access protection by using rename, link, copyfile, exchangedata, or clone operations to place or replace files inside protected directories. This vulnerability is fixed in 5.0.4-beta-1f46165.",
    "evidence": "osv:CVE-2026-40191",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-40191",
      "aliases": [
        "CVE-2026-40191",
        "GHSA-92f3-38m7-579h"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/craigjbass/clearancekit",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "1f461653d6a0afa02d5b922441ddedb7fb4433fb"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "5.0.4-beta-1f46165"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "fixed": "1f461653d6a0afa02d5b922441ddedb7fb4433fb"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v5.0.4-1f46165"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "5.0.4-beta-1f46165"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v5.0.4-beta-a993d34",
            "v5.0.4-beta-90ffdf2",
            "v5.0.4-beta-7c520a0",
            "v5.0.4-beta-7795456",
            "v5.0.4-beta-fc9d6f7",
            "v5.0.4-beta-746c770",
            "v5.0.4-beta-2ab3798",
            "v5.0.4-beta-4343a17",
            "v5.0.4-beta-3005356",
            "v5.0.4-beta-d203f0e",
            "v5.0.4-beta-9bf3d64",
            "v5.0.4-beta-e353aa8",
            "v5.0.4-beta-2441e70",
            "v5.0.3-e353aa8",
            "v5.0.3-beta-cd6f912",
            "v5.0.3-beta-3a6d0ed",
            "v5.0.3-beta-b8ebe86",
            "v5.0.3-beta-461181a",
            "v5.0.3-beta-053aa03",
            "v5.0.3-beta-ca0cb45",
            "v5.0.3-beta-dd6bc64",
            "v5.0.3-beta-15553e6",
            "v5.0.3-beta-89dfe46",
            "v5.0.3-beta-73a4f68",
            "v5.0.3-beta-4aac24c",
            "v5.0.3-beta-e3ae3ee",
            "v5.0.3-beta-6a92223",
            "v5.0.3-beta-243623e",
            "v5.0.3-beta-758469d",
            "v5.0.3-beta-b19e6a0",
            "v5.0.3-beta-331cf56",
            "v5.0.3-beta-ca77b7c",
            "v5.0.3-beta-12221d5",
            "v5.0.3-beta-3096770",
            "v5.0.3-beta-59d40fd",
            "v5.0.3-beta-4777d0a",
            "v5.0.2-4777d0a",
            "v5.0.1-beta-55e1b25",
            "v5.0.1-55e1b25",
            "v5.0.1-beta-3070e48",
            "v5.0.1-beta-c1cbf74",
            "v5.0.1-beta-c8303f6",
            "v5.0.1-beta-cfb81ad",
            "v5.0.1-beta-aa7d36b",
            "v5.0.1-beta-88cd8c1",
            "v5.0.1-beta-c9010bb",
            "v5.0.1-beta-94efede",
            "v5.0.1-beta-f579cfc",
            "v5.0.1-beta-bdb58cc",
            "v5.0.1-beta-c621aac",
            "v5.0.1-beta-2988ac7",
            "v5.0.1-beta-efaff77",
            "v5.0.1-beta-2886304",
            "v5.0.1-beta-b406f51",
            "v5.0.1-beta-8ac14af",
            "v5.0.1-beta-c21325f",
            "v4.2.18-beta-dc80da5",
            "v4.2.18-beta-a404264",
            "v4.2.18-beta-5e23596",
            "v4.2.18-beta-bcc4fad",
            "v4.2.18-beta-540674b",
            "v4.2.18-beta-fd775e1",
            "v4.2.18-beta-1b38d48",
            "v4.2.18-beta-cb50d47",
            "v4.2.18-beta-fcd63f2",
            "v4.2.18-beta-669d4f1",
            "v4.2.18-beta-0d98e32",
            "v4.2.18-beta-34a5b45",
            "v4.2.18-beta-ff065b5",
            "v4.2.18-beta-11a86c5",
            "v4.2.18-beta-d510cbd",
            "v4.2.18-beta-b228019",
            "v4.2.18-beta-cb13685",
            "v4.2.18-beta-399ecc9",
            "v4.2.18-beta-5816088",
            "v4.2.17-beta-b8d4b62",
            "v4.2.17-b8d4b62",
            "v4.2.17-beta-bb1bdb1",
            "v4.2.17-beta-4a39af5",
            "v4.2.17-beta-59eff6c",
            "v4.2.17-beta-6bb5985",
            "v4.2.17-beta-95857bc",
            "v4.2.16-95857bc",
            "v4.2.15-beta-328eb4e",
            "v4.2.15-328eb4e",
            "v4.2.15-beta-59ab090",
            "v4.2.15-beta-cb9c418",
            "v4.2.14-beta-56d617b",
            "v4.2.14-56d617b",
            "v4.2.13-ddfdacb",
            "v4.2.12-beta-ddfdacb",
            "v4.2.12-beta-70dd223",
            "v4.2.12-beta-2bd354b",
            "v4.2.12-beta-3ce0726",
            "v4.2.12-beta-4e235b6",
            "v4.2.12-beta-6eadd6a",
            "v4.2.12-beta-8a28803",
            "v4.2.12-beta-9cfec23",
            "v4.2.12-beta-9dd7fc2",
            "v4.2.12-beta-25c25f0",
            "v4.2.12-beta-e9b99e2",
            "v4.2.12-beta-c380cfb",
            "v4.2.12-beta-97eb073",
            "v4.2.11-97eb073",
            "v4.2.11-beta-f1afa86",
            "v4.2.11-beta-caef71c",
            "v4.2.10-d078fba",
            "v4.2.10-beta-d078fba",
            "v4.2.9-1bd9a4b",
            "v4.2.10-beta-1bd9a4b",
            "v4.2.9-beta-7768ef9",
            "v4.2.9-beta-17cd99f",
            "v4.2.9-beta-eed8ad3",
            "v4.2.9-beta-8fcabc9",
            "v4.2.9-beta-43f52c8",
            "v4.2.9-beta-48d9e4b",
            "v4.2.9-beta-fe1590d",
            "v4.2.9-beta-db4dee9",
            "v4.2.9-beta-58ad180",
            "v4.2.9-beta-ba38640",
            "v4.2.9-beta-0a8cd29",
            "v4.2.9-beta-5ffabaf",
            "v4.2.9-beta-8b7f499",
            "v4.2.9-beta-217a1fb",
            "v4.2.9-beta-3a9e8c7",
            "v4.2.9-beta-c21ad1e",
            "v4.2.9-beta-2c78ce1",
            "v4.2.9-beta-cd8eec6",
            "v4.2.9-beta-690e5fd",
            "v4.2.9-beta-e5bed60",
            "v4.2.9-beta-c9f6efa",
            "v4.2.9-beta-0c7f3d1",
            "v4.2.9-beta-88a324e",
            "v4.2.9-beta-52d3a07",
            "v4.2.9-beta-6f2122a",
            "v4.2.9-beta-704d137",
            "v4.2.9-beta-25e1230",
            "v4.2.9-beta-7d215cd",
            "v4.2.9-beta-2924fec",
            "v4.2.9-beta-f5efabc",
            "v4.2.8-e9ab07b",
            "v4.2.8-beta-e9ab07b",
            "v4.2.8-beta-954bb2a",
            "v4.2.8-beta-f51fc8e",
            "v4.2.8-beta-fcbe4ec",
            "v4.2.8-beta-f606b7a",
            "v4.2.8-beta-1c17230",
            "v4.2.8-beta-23e30c5",
            "v4.2.8-beta-9ab4936",
            "v4.2.8-beta-723e90c",
            "v4.2.8-beta-046a61a",
            "v4.2.8-beta-f84e3d4",
            "v4.2.8-beta-34142ac",
            "v4.2.8-beta-2f491e6",
            "v4.2.8-beta-3440884",
            "v4.2.8-beta-8df99b8",
            "v4.2.8-beta-941ba0d",
            "v4.2.8-beta-11ee34c",
            "v4.2.8-beta-f55f283",
            "v4.2.8-beta-f1a2de7",
            "v4.2.8-beta-aa06e60",
            "v4.2.8-beta-14393bb",
            "v4.2.8-beta-844141b",
            "v4.2.8-beta-9f81d2d",
            "v4.2.8-beta-96049f8",
            "v4.2.7-beta-1c782a1",
            "v4.2.7-1c782a1",
            "v4.2.7-beta-1cc0a77",
            "v4.2.7-beta-88b2b3a",
            "v4.2.7-beta-b39d99a",
            "v4.2.7-beta-7ad2f7d",
            "v4.2.7-beta-268aa55",
            "v4.2.7-beta-65c19c6",
            "v4.2.7-beta-e0e2967",
            "v4.2.6-e3bced6",
            "v4.2.6-beta-e9d43ea",
            "v4.2.6-beta-e3bced6",
            "v4.2.6-beta-5554edf",
            "v4.2.6-beta-e3fec11",
            "v4.2.6-beta-77386f2",
            "v4.2.6-beta-4a29601",
            "v4.2.6-beta-e92e21e",
            "v4.2.6-beta-688192a",
            "v4.2.6-beta-9cab2ff",
            "v4.2.6-beta-e3e33ea",
            "v4.2.6-beta-0ba8b30",
            "v4.2.6-beta-521fc32",
            "v4.2.6-beta-ec8db39",
            "v4.2.6-beta-a77902b",
            "v4.2.1-beta-0943b9a",
            "v4.2.1-beta-1446c6b",
            "v4.2.6-beta-505afd6",
            "v4.2.5-0ab246c",
            "v4.2.4-6181c4a",
            "v4.2.3-d488a1e",
            "v4.2.2-d44ae9d",
            "v4.2.1-7b10538",
            "v4.2-f5f9534",
            "v4.2-9997343",
            "v4.2-64f154d",
            "v4.2-3379a1c",
            "v4.2-a6926d4",
            "v4.2-10c19ed",
            "v4.2-da58a49",
            "v4.1-dfed70f",
            "v4.1-8386ae0",
            "v4.1-df4a170",
            "v4.1-16a3e37",
            "v4.1-6bcaabe",
            "v4.1-fd5fab3",
            "v4.1-3594f78",
            "v4.1-981728f",
            "v4.0-e2705e0",
            "v4.0-2ccd30f",
            "v4.0-b574aa3",
            "v4.0-eca88d7",
            "v4.0-3f01958",
            "v4.0-db67c62",
            "v4.0-5a0de89",
            "v4.0-f8c9232",
            "v4.0-c828d5e",
            "v4.0-19126ba",
            "v4.0-8fc8884",
            "v3.3-9bb62a6",
            "v3.2-9bb23fd",
            "v3.1-34107d6",
            "v3.1-9444cb6",
            "v3.1-9ae9a1e",
            "v3.1-1c065f7",
            "v3.1-b616763",
            "v3.1-56cf8aa",
            "v3.1-bab7abf",
            "v3.1-a563b4b",
            "v3.1-2bc8773",
            "v3.1-f48c585",
            "v3.1-f9c7713",
            "v3.1-def8687",
            "v3.1-1480877",
            "v3.1-962116d",
            "v3.1-781fe68"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40191.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:33.613700240Z",
      "provider": "osv",
      "references": [
        "https://github.com/craigjbass/clearancekit/releases/tag/v5.0.4-1f46165",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40191.json",
        "https://github.com/craigjbass/clearancekit/security/advisories/GHSA-92f3-38m7-579h",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-40191"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-863"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40191.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-40191",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 500968,
  "published_at": "2026-04-10T20:19:35.909+00:00"
}