ClearanceKit monitors filesystem events on macOS and enforces per‑process access policies that are signed with an ECDSA private key stored in the System Keychain. The key is created in memory with SecKeyCreateRandomKey and subsequently persisted via SecItemAdd. In versions prior to 5.0.10, the access control attribute (kSecAttrAccess) supplied for kSecClassKey items is ignored, so the key is stored without an ACL. This allows any root‑privileged process to retrieve the private key from the System Keychain and sign arbitrary policy files. ClearanceKit accepts these forged signatures, letting a local root user inject malicious policies that bypass the intended access controls and effectively compromise the integrity of the policy enforcement. The issue is specific to the EC key, as the same access builder correctly binds the ACL for generic password items.

ClearanceKit (production by craigjbass) on macOS is affected. All instances with a version earlier than 5.0.10 are vulnerable. Users running ClearanceKit who have processes that run as root are at risk until they upgrade.

The CVSS score of 6.9 indicates a medium severity vulnerability. The EPSS score is below 1%, indicating a low likelihood of global exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires local root privileges; any privileged process on the host can use the key to forge policy signatures, potentially allowing a malicious user to modify or extend access rules. The vulnerability’s exploitability is constrained to systems where ClearanceKit is installed and running, but once exploited it provides significant integrity compromise of the policy enforcement function.