---
id: CVE-2026-34218
title: >-
  ClearanceKit intercepts file-system access events on macOS and enforces
  per-process access policies
summary: >-
  ClearanceKit intercepts file-system access events on macOS and enforces
  per-process access policies. Prior to version 4.2.14, two related startup
  defects created a window during which only the single compile-time baseline
  rule was enforc…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-269
vendor: craigjbass
product: clearancekit
affected:
  - clearancekit < 4.2.14
patched:
  - clearancekit 4.2.14
published: '2026-03-31'
updated: '2026-07-24'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-34218'
references:
  - url: >-
      https://github.com/craigjbass/clearancekit/commit/56d617b778c571e3c29b803636d9807940992daa
    label: security-advisories@github.com
  - url: >-
      https://github.com/craigjbass/clearancekit/commit/ddfdacb2633681bbd9c2f41dbd536ea039386628
    label: security-advisories@github.com
  - url: >-
      https://github.com/craigjbass/clearancekit/security/advisories/GHSA-fpmv-5wgw-qhhr
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00154
epssPercentile: 0.0382
ingestedAt: '2026-07-24T20:38:02.312Z'
---

## Overview

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 4.2.14, two related startup defects created a window during which only the single compile-time baseline rule was enforced by opfilter. All managed (MDM-delivered) and user-defined file-access rules were not applied until the user interacted with policies through the GUI, triggering a policy mutation over XPC. This issue has been patched in version 4.2.14.

## Affected

- `clearancekit < 4.2.14`

## Remediation

Upgrade past the affected range:

- `clearancekit 4.2.14`