Skip to content
Heist/ feed
Back to feed
Medium

ClearanceKit: Policy signing key in System Keychain has permissive ACL allowing any local-root process to forge signed policy

Type: advisorySources: OSV

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. The ECDSA private key used to sign the on-disk policy database (`/Library/Application Support/clearancekit/store.db`) is stored in the macOS System Keychain. The key was created via the two-step pattern `SecKeyCreateRandomKey` (in-memory) followed by `SecItemAdd(kSecValueRef:, kSecAttrAccess:)` (persist). Prior to version 5.0.10, for `kSecClassKey` items in the legacy System Keychain, `kSecAttrAccess` passed to `SecItemAdd` is silently ignored — the persisted key inherits no ACL restriction. The same access builder applied to `kSecClassGenericPassword` items correctly binds the ACL, making this bug specific to the EC key. The result is that any process running as root can use the key to produce valid signatures over arbitrary policy content. Version 5.0.10 fixes the issue. No known workarounds are available. Disabling the system extension and manually removing the System Keychain item labelled `clearancekit policy signing key` would prevent the forged-signature path but also disables policy enforcement.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-47134
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 14:09 UTC · Revision 1

Source evidence

ClearanceKit: Policy signing key in System Keychain has permissive ACL allowing any local-root process to forge signed policy

core-osv · Original source

Published 20 Jul 2026, 21:17 UTC

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. The ECDSA private key used to sign the on-disk policy database (`/Library/Application Support/clearancekit/store.db`) is stored in the macOS System Keychain. The key was created via the two-step pattern `SecKeyCreateRandomKey` (in-memory) followed by `SecItemAdd(kSecValueRef:, kSecAttrAccess:)` (persist). Prior to version 5.0.10, for `kSecClassKey` items in the legacy System Keychain, `kSecAttrAccess` passed to `SecItemAdd` is silently ignored — the persisted key inherits no ACL restriction. The same access builder applied to `kSecClassGenericPassword` items correctly binds the ACL, making this bug specific to the EC key. The result is that any process running as root can use the key to produce valid signatures over arbitrary policy content. Version 5.0.10 fixes the issue. No known workarounds are available. Disabling the system extension and manually removing the System Keychain item labelled `clearancekit policy signing key` would prevent the forged-signature path but also disables policy enforcement.

osv:CVE-2026-47134
Complete source record
{
  "id": "5fc8aa86502b557119f271d52d10fb77d01be57626d5491af252b92196c3e6aa",
  "url": "https://osv.dev/vulnerability/CVE-2026-47134",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "ClearanceKit: Policy signing key in System Keychain has permissive ACL allowing any local-root process to forge signed policy",
    "summary": "ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. The ECDSA private key used to sign the on-disk policy database (`/Library/Application Support/clearancekit/store.db`) is stored in the macOS System Keychain. The key was created via the two-step pattern `SecKeyCreateRandomKey` (in-memory) followed by `SecItemAdd(kSecValueRef:, kSecAttrAccess:)` (persist). Prior to version 5.0.10, for `kSecClassKey` items in the legacy System Keychain, `kSecAttrAccess` passed to `SecItemAdd` is silently ignored — the persisted key inherits no ACL restriction. The same access builder applied to `kSecClassGenericPassword` items correctly binds the ACL, making this bug specific to the EC key. The result is that any process running as root can use the key to produce valid signatures over arbitrary policy content. Version 5.0.10 fixes the issue. No known workarounds are available. Disabling the system extension and manually removing the System Keychain item labelled `clearancekit policy signing key` would prevent the forged-signature path but also disables policy enforcement.",
    "evidence": "osv:CVE-2026-47134",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-47134",
      "aliases": [
        "CVE-2026-47134",
        "GHSA-w254-hxm5-3hgh"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/craigjbass/clearancekit",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "afb9006638e4fd8bd1b134b26bb938b5b22d85b4"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "5.0.10"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "5.0.10"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v5.0.10-beta-481a53f",
            "v5.0.10-beta-b4b91e5",
            "v5.0.10-beta-5780b84",
            "v5.0.10-beta-8e0a2e7",
            "v5.0.10-beta-40894f9",
            "v5.0.10-beta-f4fba42",
            "v5.0.10-beta-1ecf73c",
            "v5.0.10-beta-e34820d",
            "v5.0.10-beta-578aebc",
            "v5.0.10-beta-b98d3cd",
            "v5.0.10-beta-324dedc",
            "v5.0.10-beta-a7227fa",
            "v5.0.10-beta-f7a57d6",
            "v5.0.10-beta-42fc946",
            "v5.0.10-beta-c1747fa",
            "v5.0.10-beta-eab3c5d",
            "v5.0.9-beta-06ab4d1",
            "v5.0.9-06ab4d1",
            "v5.0.9-beta-763cd21",
            "v5.0.8-beta-05b0a45",
            "v5.0.8-05b0a45",
            "v5.0.8-beta-c17e090",
            "v5.0.8-beta-a404e56",
            "v5.0.7-beta-506cefb",
            "v5.0.7-506cefb",
            "v5.0.7-beta-901b9c4",
            "v5.0.7-beta-2690d48",
            "v5.0.7-beta-9118d3d",
            "v5.0.7-beta-13ab01d",
            "v5.0.7-beta-7c45e68",
            "v5.0.7-beta-bced2a8",
            "v5.0.7-beta-8d1de5f",
            "v5.0.7-beta-86ffb08",
            "v5.0.7-beta-f9cee89",
            "v5.0.7-beta-3606708",
            "v5.0.7-beta-92d038f",
            "v5.0.7-beta-353a08c",
            "v5.0.7-beta-779f01d",
            "v5.0.7-beta-99574f3",
            "v5.0.7-beta-945f571",
            "v5.0.7-beta-b8f20c4",
            "v5.0.7-beta-319c8d4",
            "v5.0.7-beta-6233b33",
            "v5.0.7-beta-5db2699",
            "v5.0.7-beta-d6a765c",
            "v5.0.6-d6a765c",
            "v5.0.5-caaf673",
            "v5.0.5-beta-caaf673",
            "v5.0.5-beta-2a7f718",
            "v5.0.5-beta-bef6534",
            "v5.0.5-beta-c2f8d0d",
            "v5.0.5-beta-3f49a49",
            "v5.0.5-beta-ec72fcc",
            "v5.0.5-beta-3b9b55d",
            "v5.0.5-beta-d1798c4",
            "v5.0.5-beta-2482275",
            "v5.0.5-beta-f5ccbe5",
            "v5.0.5-beta-5bc5829",
            "v5.0.5-beta-021d859",
            "v5.0.5-beta-c6cff32",
            "v5.0.5-beta-a782de7",
            "v5.0.5-beta-4f6ef83",
            "v5.0.5-beta-4eead5d",
            "v5.0.5-beta-f28024e",
            "v5.0.5-beta-38f7c2e",
            "v5.0.5-beta-890a08d",
            "v5.0.5-beta-cf705ac",
            "v5.0.5-beta-b5ace27",
            "v5.0.5-beta-b7131a2",
            "v5.0.5-beta-7a4ab7e",
            "v5.0.5-beta-7e2e888",
            "v5.0.5-beta-8a30ca9",
            "v5.0.5-beta-3316277",
            "v5.0.5-beta-88d7d25",
            "v5.0.5-beta-471e377",
            "v5.0.5-beta-42f1098",
            "v5.0.5-beta-ccb76b9",
            "v5.0.5-beta-6aca802",
            "v5.0.4-beta-1f46165",
            "v5.0.4-1f46165",
            "v5.0.4-beta-a993d34",
            "v5.0.4-beta-90ffdf2",
            "v5.0.4-beta-7c520a0",
            "v5.0.4-beta-7795456",
            "v5.0.4-beta-fc9d6f7",
            "v5.0.4-beta-746c770",
            "v5.0.4-beta-2ab3798",
            "v5.0.4-beta-4343a17",
            "v5.0.4-beta-3005356",
            "v5.0.4-beta-d203f0e",
            "v5.0.4-beta-9bf3d64",
            "v5.0.4-beta-e353aa8",
            "v5.0.4-beta-2441e70",
            "v5.0.3-e353aa8",
            "v5.0.3-beta-cd6f912",
            "v5.0.3-beta-3a6d0ed",
            "v5.0.3-beta-b8ebe86",
            "v5.0.3-beta-461181a",
            "v5.0.3-beta-053aa03",
            "v5.0.3-beta-ca0cb45",
            "v5.0.3-beta-dd6bc64",
            "v5.0.3-beta-15553e6",
            "v5.0.3-beta-89dfe46",
            "v5.0.3-beta-73a4f68",
            "v5.0.3-beta-4aac24c",
            "v5.0.3-beta-e3ae3ee",
            "v5.0.3-beta-6a92223",
            "v5.0.3-beta-243623e",
            "v5.0.3-beta-758469d",
            "v5.0.3-beta-b19e6a0",
            "v5.0.3-beta-331cf56",
            "v5.0.3-beta-ca77b7c",
            "v5.0.3-beta-12221d5",
            "v5.0.3-beta-3096770",
            "v5.0.3-beta-59d40fd",
            "v5.0.3-beta-4777d0a",
            "v5.0.2-4777d0a",
            "v5.0.1-beta-55e1b25",
            "v5.0.1-55e1b25",
            "v5.0.1-beta-3070e48",
            "v5.0.1-beta-c1cbf74",
            "v5.0.1-beta-c8303f6",
            "v5.0.1-beta-cfb81ad",
            "v5.0.1-beta-aa7d36b",
            "v5.0.1-beta-88cd8c1",
            "v5.0.1-beta-c9010bb",
            "v5.0.1-beta-94efede",
            "v5.0.1-beta-f579cfc",
            "v5.0.1-beta-bdb58cc",
            "v5.0.1-beta-c621aac",
            "v5.0.1-beta-2988ac7",
            "v5.0.1-beta-efaff77",
            "v5.0.1-beta-2886304",
            "v5.0.1-beta-b406f51",
            "v5.0.1-beta-8ac14af",
            "v5.0.1-beta-c21325f",
            "v4.2.18-beta-dc80da5",
            "v4.2.18-beta-a404264",
            "v4.2.18-beta-5e23596",
            "v4.2.18-beta-bcc4fad",
            "v4.2.18-beta-540674b",
            "v4.2.18-beta-fd775e1",
            "v4.2.18-beta-1b38d48",
            "v4.2.18-beta-cb50d47",
            "v4.2.18-beta-fcd63f2",
            "v4.2.18-beta-669d4f1",
            "v4.2.18-beta-0d98e32",
            "v4.2.18-beta-34a5b45",
            "v4.2.18-beta-ff065b5",
            "v4.2.18-beta-11a86c5",
            "v4.2.18-beta-d510cbd",
            "v4.2.18-beta-b228019",
            "v4.2.18-beta-cb13685",
            "v4.2.18-beta-399ecc9",
            "v4.2.18-beta-5816088",
            "v4.2.17-beta-b8d4b62",
            "v4.2.17-b8d4b62",
            "v4.2.17-beta-bb1bdb1",
            "v4.2.17-beta-4a39af5",
            "v4.2.17-beta-59eff6c",
            "v4.2.17-beta-6bb5985",
            "v4.2.17-beta-95857bc",
            "v4.2.16-95857bc",
            "v4.2.15-beta-328eb4e",
            "v4.2.15-328eb4e",
            "v4.2.15-beta-59ab090",
            "v4.2.15-beta-cb9c418",
            "v4.2.14-beta-56d617b",
            "v4.2.14-56d617b",
            "v4.2.13-ddfdacb",
            "v4.2.12-beta-ddfdacb",
            "v4.2.12-beta-70dd223",
            "v4.2.12-beta-2bd354b",
            "v4.2.12-beta-3ce0726",
            "v4.2.12-beta-4e235b6",
            "v4.2.12-beta-6eadd6a",
            "v4.2.12-beta-8a28803",
            "v4.2.12-beta-9cfec23",
            "v4.2.12-beta-9dd7fc2",
            "v4.2.12-beta-25c25f0",
            "v4.2.12-beta-e9b99e2",
            "v4.2.12-beta-c380cfb",
            "v4.2.12-beta-97eb073",
            "v4.2.11-97eb073",
            "v4.2.11-beta-f1afa86",
            "v4.2.11-beta-caef71c",
            "v4.2.10-d078fba",
            "v4.2.10-beta-d078fba",
            "v4.2.9-1bd9a4b",
            "v4.2.10-beta-1bd9a4b",
            "v4.2.9-beta-7768ef9",
            "v4.2.9-beta-17cd99f",
            "v4.2.9-beta-eed8ad3",
            "v4.2.9-beta-8fcabc9",
            "v4.2.9-beta-43f52c8",
            "v4.2.9-beta-48d9e4b",
            "v4.2.9-beta-fe1590d",
            "v4.2.9-beta-db4dee9",
            "v4.2.9-beta-58ad180",
            "v4.2.9-beta-ba38640",
            "v4.2.9-beta-0a8cd29",
            "v4.2.9-beta-5ffabaf",
            "v4.2.9-beta-8b7f499",
            "v4.2.9-beta-217a1fb",
            "v4.2.9-beta-3a9e8c7",
            "v4.2.9-beta-c21ad1e",
            "v4.2.9-beta-2c78ce1",
            "v4.2.9-beta-cd8eec6",
            "v4.2.9-beta-690e5fd",
            "v4.2.9-beta-e5bed60",
            "v4.2.9-beta-c9f6efa",
            "v4.2.9-beta-0c7f3d1",
            "v4.2.9-beta-88a324e",
            "v4.2.9-beta-52d3a07",
            "v4.2.9-beta-6f2122a",
            "v4.2.9-beta-704d137",
            "v4.2.9-beta-25e1230",
            "v4.2.9-beta-7d215cd",
            "v4.2.9-beta-2924fec",
            "v4.2.9-beta-f5efabc",
            "v4.2.8-e9ab07b",
            "v4.2.8-beta-e9ab07b",
            "v4.2.8-beta-954bb2a",
            "v4.2.8-beta-f51fc8e",
            "v4.2.8-beta-fcbe4ec",
            "v4.2.8-beta-f606b7a",
            "v4.2.8-beta-1c17230",
            "v4.2.8-beta-23e30c5",
            "v4.2.8-beta-9ab4936",
            "v4.2.8-beta-723e90c",
            "v4.2.8-beta-046a61a",
            "v4.2.8-beta-f84e3d4",
            "v4.2.8-beta-34142ac",
            "v4.2.8-beta-2f491e6",
            "v4.2.8-beta-3440884",
            "v4.2.8-beta-8df99b8",
            "v4.2.8-beta-941ba0d",
            "v4.2.8-beta-11ee34c",
            "v4.2.8-beta-f55f283",
            "v4.2.8-beta-f1a2de7",
            "v4.2.8-beta-aa06e60",
            "v4.2.8-beta-14393bb",
            "v4.2.8-beta-844141b",
            "v4.2.8-beta-9f81d2d",
            "v4.2.8-beta-96049f8",
            "v4.2.7-beta-1c782a1",
            "v4.2.7-1c782a1",
            "v4.2.7-beta-1cc0a77",
            "v4.2.7-beta-88b2b3a",
            "v4.2.7-beta-b39d99a",
            "v4.2.7-beta-7ad2f7d",
            "v4.2.7-beta-268aa55",
            "v4.2.7-beta-65c19c6",
            "v4.2.7-beta-e0e2967",
            "v4.2.6-e3bced6",
            "v4.2.6-beta-e9d43ea",
            "v4.2.6-beta-e3bced6",
            "v4.2.6-beta-5554edf",
            "v4.2.6-beta-e3fec11",
            "v4.2.6-beta-77386f2",
            "v4.2.6-beta-4a29601",
            "v4.2.6-beta-e92e21e",
            "v4.2.6-beta-688192a",
            "v4.2.6-beta-9cab2ff",
            "v4.2.6-beta-e3e33ea",
            "v4.2.6-beta-0ba8b30",
            "v4.2.6-beta-521fc32",
            "v4.2.6-beta-ec8db39",
            "v4.2.6-beta-a77902b",
            "v4.2.1-beta-0943b9a",
            "v4.2.1-beta-1446c6b",
            "v4.2.6-beta-505afd6",
            "v4.2.5-0ab246c",
            "v4.2.4-6181c4a",
            "v4.2.3-d488a1e",
            "v4.2.2-d44ae9d",
            "v4.2.1-7b10538",
            "v4.2-f5f9534",
            "v4.2-9997343",
            "v4.2-64f154d",
            "v4.2-3379a1c",
            "v4.2-a6926d4",
            "v4.2-10c19ed",
            "v4.2-da58a49",
            "v4.1-dfed70f",
            "v4.1-8386ae0",
            "v4.1-df4a170",
            "v4.1-16a3e37",
            "v4.1-6bcaabe",
            "v4.1-fd5fab3",
            "v4.1-3594f78",
            "v4.1-981728f",
            "v4.0-e2705e0",
            "v4.0-2ccd30f",
            "v4.0-b574aa3",
            "v4.0-eca88d7",
            "v4.0-3f01958",
            "v4.0-db67c62",
            "v4.0-5a0de89",
            "v4.0-f8c9232",
            "v4.0-c828d5e",
            "v4.0-19126ba",
            "v4.0-8fc8884",
            "v3.3-9bb62a6",
            "v3.2-9bb23fd",
            "v3.1-34107d6",
            "v3.1-9444cb6",
            "v3.1-9ae9a1e",
            "v3.1-1c065f7",
            "v3.1-b616763",
            "v3.1-56cf8aa",
            "v3.1-bab7abf",
            "v3.1-a563b4b",
            "v3.1-2bc8773",
            "v3.1-f48c585",
            "v3.1-f9c7713",
            "v3.1-def8687",
            "v3.1-1480877",
            "v3.1-962116d",
            "v3.1-781fe68"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-47134.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:36.054773115Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47134.json",
        "https://github.com/craigjbass/clearancekit/security/advisories/GHSA-w254-hxm5-3hgh",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-47134"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-732"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47134.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-47134",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 503490,
  "published_at": "2026-07-20T21:17:22.539+00:00"
}