High severity7.8NVD Advisory· Published Apr 8, 2026· Updated Apr 14, 2026
CVE-2026-27806
CVE-2026-27806
Description
Fleet is open source device management software. Prior to 4.81.1, the Orbit agent's FileVault disk encryption key rotation flow on collects a local user's password via a GUI dialog and interpolates it directly into a Tcl/expect script executed via exec.Command("expect", "-c", script). Because the password is inserted into Tcl brace-quoted send {%s}, a password containing } terminates the literal and injects arbitrary Tcl commands. Since Orbit runs as root, this allows a local unprivileged user to escalate to root privileges. This vulnerability is fixed in 4.81.1.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/fleetdm/fleet/v4Go | < 4.81.1 | 4.81.1 |
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- github.com/advisories/GHSA-rphv-h674-5hp2ghsaADVISORY
- github.com/fleetdm/fleet/security/advisories/GHSA-rphv-h674-5hp2nvdVendor AdvisoryWEB
News mentions
0No linked articles in our index yet.