What’s Vulnerable › Vulnerabilities
CVE-2026-27806: Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-04-08 · updated 2026-07-25
- Weakness: CWE-78
Description
Fleet is open source device management software. Prior to 4.81.1, the Orbit agent's FileVault disk encryption key rotation flow on collects a local user's password via a GUI dialog and interpolates it directly into a Tcl/expect script executed via exec.Command("expect", "-c", script). Because the password is inserted into Tcl brace-quoted send {%s}, a password containing } terminates the literal and injects arbitrary Tcl commands. Since Orbit runs as root, this allows a local unprivileged user to escalate to root privileges. This vulnerability is fixed in 4.81.1.
Affected products
- fleetdm fleet: before 4.81.1 — fixed in 4.81.1
How to fix
Upgrade to a fixed version: fleetdm fleet 4.81.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-27806 or the next vulnerability affects your stack