CVE-2026-40599

CVE-2026-40599 is an authentication bypass vulnerability in ClearanceKit, a macOS file-system access control tool, versions prior to 5.0.5. The flaw allows malicious software to impersonate Apple platform binaries by exploiting improper validation of process signing credentials, specifically when a process has an empty Team ID and non-empty Signing ID. The vulnerability presents a moderate security risk with a FAUCET Risk Score of 41.0/100. An attacker would need to execute code locally to exploit this flaw, but once done, the attack is relatively straightforward. Successful exploitation grants unauthorized access to all protected files on the affected system, bypassing the intended per-process access policies that ClearanceKit enforces. There is no evidence of active exploitation in the wild. The vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog, and it remains on the inactive Hot List. The low EPSS score of 0.000130000 indicates minimal current exploitation activity. Users should prioritize updating ClearanceKit to version 5.0.5 or later to remediate this issue, particularly in environments where file-system protection controls are critical.