High severity7.8NVD Advisory· Published Apr 8, 2026· Updated Jul 25, 2026
CVE-2026-27806
CVE-2026-27806
Description
Fleet is open source device management software. Prior to 4.81.1, the Orbit agent's FileVault disk encryption key rotation flow on collects a local user's password via a GUI dialog and interpolates it directly into a Tcl/expect script executed via exec.Command("expect", "-c", script). Because the password is inserted into Tcl brace-quoted send {%s}, a password containing } terminates the literal and injects arbitrary Tcl commands. Since Orbit runs as root, this allows a local unprivileged user to escalate to root privileges. This vulnerability is fixed in 4.81.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/fleetdm/fleet/v4Go | < 4.81.1 | 4.81.1 |
Affected products
3- ghsa-coords2 versionspkg:golang/github.com/fleetdm/fleet/v4pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0
< 4.81.1+ 1 more
- (no CPE)range: < 4.81.1
- (no CPE)range: < 0.0.20260723T184607-160000.1.1
Patches
Vulnerability mechanics
References
2- github.com/advisories/GHSA-rphv-h674-5hp2ghsaADVISORY
- github.com/fleetdm/fleet/security/advisories/GHSA-rphv-h674-5hp2nvdVendor AdvisoryWEB
News mentions
0No linked articles in our index yet.