CVE-2026-27806: Fleet Orbit Agent Privilege Escalation

CVE-2026-27806 Overview

Fleet is open source device management software. Prior to version 4.81.1, the Orbit agent's FileVault disk encryption key rotation flow on macOS collects a local user's password via a GUI dialog and interpolates it directly into a Tcl/expect script executed via exec.Command("expect", "-c", script). Because the password is inserted into Tcl brace-quoted send {%s}, a password containing } terminates the literal and injects arbitrary Tcl commands. Since Orbit runs as root, this allows a local unprivileged user to escalate to root privileges.

Critical Impact

Local unprivileged users can escalate to root privileges by crafting a malicious password containing Tcl escape sequences during the FileVault key rotation process.

Affected Products

• Fleet versions prior to 4.81.1
• Fleet Orbit agent on macOS systems with FileVault enabled
• Systems utilizing Fleet's disk encryption key rotation feature

Discovery Timeline

• 2026-04-08 - CVE CVE-2026-27806 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-27806

Vulnerability Analysis

This vulnerability represents a classic command injection flaw (CWE-78) within the Fleet Orbit agent's FileVault disk encryption key rotation workflow. The core issue stems from improper handling of user-supplied input—specifically, the local user's password—when constructing a Tcl/expect script.

The Orbit agent collects passwords through a GUI dialog during the FileVault key rotation process. This password is then directly interpolated into a Tcl script using brace-quoted syntax (send {%s}). In Tcl, braces are used to prevent variable and command substitution, but the closing brace character } can terminate this literal string prematurely.

When a user supplies a password containing the } character, the brace-quoted string is terminated early, allowing any subsequent characters to be interpreted as Tcl commands. Since the Orbit agent executes with root privileges, any injected Tcl commands will also execute with root privileges, enabling complete system compromise.

Root Cause

The root cause is insufficient input sanitization when constructing the Tcl/expect script. The password value is inserted directly into the script without escaping special Tcl characters, particularly the closing brace }. This violates the principle of never trusting user input, especially when that input is used in command construction contexts.

The vulnerable code path uses Go's exec.Command("expect", "-c", script) to execute the dynamically constructed Tcl script, passing the unsanitized password directly into the command string.

Attack Vector

The attack requires local access to the system where Fleet Orbit is installed. An attacker must:

1. Be a local unprivileged user on a macOS system running Fleet Orbit
2. Wait for or trigger a FileVault disk encryption key rotation event
3. Enter a specially crafted password containing } followed by arbitrary Tcl commands
4. The injected commands execute with root privileges when the Orbit agent processes the password

The vulnerability is exploited through the password input dialog. When prompted for their password during key rotation, a malicious user enters a password such as password} ; exec /bin/bash -c "malicious_command" ; # which breaks out of the brace-quoted context and executes arbitrary commands as root.

Detection Methods for CVE-2026-27806

Indicators of Compromise

• Unexpected processes spawned as children of the Orbit agent process
• Unusual command executions originating from expect or Tcl interpreters running as root
• Modified system files or new user accounts created following FileVault key rotation events
• Suspicious entries in system logs around the time of FileVault operations

Detection Strategies

• Monitor for anomalous child processes spawned by the Fleet Orbit agent, particularly shell processes or unexpected binaries
• Implement file integrity monitoring on critical system files to detect unauthorized modifications following key rotation
• Review authentication logs for FileVault key rotation events followed by suspicious activity
• Deploy endpoint detection rules to alert on command injection patterns in process command lines

Monitoring Recommendations

• Enable verbose logging for the Fleet Orbit agent to capture detailed activity during key rotation operations
• Configure alerts for any root-level command execution that does not match expected FileVault rotation behavior
• Monitor for creation of new privileged accounts or modification of sudoers configurations
• Implement real-time process monitoring to detect Tcl/expect processes executing unexpected commands

How to Mitigate CVE-2026-27806

Immediate Actions Required

• Upgrade Fleet to version 4.81.1 or later immediately on all managed systems
• Temporarily disable automatic FileVault key rotation until patching is complete
• Review system logs for any signs of exploitation during the vulnerable period
• Audit privileged account activity on systems that may have been exposed

Patch Information

Fleet has released version 4.81.1 which addresses this vulnerability. The fix properly sanitizes user-supplied passwords before interpolating them into Tcl scripts, preventing command injection. Organizations should prioritize upgrading all Fleet installations and Orbit agents to this patched version.

For detailed information about the security fix, refer to the GitHub Security Advisory.

Workarounds

• Disable FileVault key rotation functionality until the patch can be applied
• Implement strict access controls limiting which users can interact with the Orbit agent
• Consider temporarily uninstalling the Orbit agent on high-value systems until patching is complete
• Monitor for and alert on any FileVault key rotation attempts on unpatched systems

If immediate patching is not possible, administrators can disable the FileVault key rotation feature through Fleet's configuration management interface until the upgrade can be scheduled. Consult Fleet documentation for specific configuration options to disable this functionality.