CVE-2026-40604 HIGH

CVE-2026-40604: ClearanceKit: opfilter system extension can be suspended or signalled by a root process, disabling file-access policy enforcement

Vendor Craigjbass
Product clearancekit
Weakness CWE-693
Published April 21, 2026
Last update April 21, 2026
View on NVD All CVEs

CVSS base score

8.2/10
Attack vector Local
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:H/SI:H/SA:N

What the vulnerability does

01Description

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.6, the opfilter Endpoint Security system extension (bundle ID uk.craigbass.clearancekit.opfilter) can be suspended with SIGSTOP or kill -STOP, or killed with SIGKILL/SIGTERM, by any process running as root. While the extension is suspended, all AUTH Endpoint Security events time out and default to allow, silently disabling ClearanceKit's file-access policy enforcement for the duration of the suspension. This vulnerability is fixed in 5.0.6.

Key dates

02Disclosure timeline

April 21, 2026 CVE published
April 21, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-38070 Windows LockDown Policy (WLDP) Security Feature Bypass Vulnerability CVE-2026-21513 MSHTML Framework Security Feature Bypass Vulnerability CVE-2025-24061 Windows Mark of the Web Security Feature Bypass Vulnerability CVE-2017-6261 NVIDIA’s Vibrante Linux version 1.1, 2.0, and 2.2 contains a vulnerability in the user space driver in which protection mechanisms are insufficient, may lead to denial of service or information disclosure CVE-2021-3453