CVE-2026-27806: Fleet Orbit local privilege escalation via Tcl injection in FileVault flow

CVE-2026-27806 · Severity: high · CVSS 7.8 · Published 2026-04-08

Fleet is an open-source tool used by organizations to manage and secure their fleet of laptops and servers. A security flaw in the Orbit agent component allows a local user on a managed computer to gain full administrative (root) control over that device. This occurs because the software does not properly handle certain characters in passwords during the disk encryption setup process, allowing a malicious user to trick the system into running unauthorized commands.

Technologies: github.com/fleetdm/fleet/v4 (Go). Vendors: Fleet Device Management, Go.

Quick answers

Is CVE-2026-27806 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-27806 being exploited in the wild.
How severe is CVE-2026-27806?
High severity, with a CVSS score of 7.8, published 8 April 2026.
Which products and versions are affected?
Fleet Device Management Orbit < 4.81.1; github.com/fleetdm/fleet/v4 (Go) < 4.81.1, SEMVER:introduced=0,fixed=4.81.1.
Is there a fix for CVE-2026-27806?
Yes. github.com/fleetdm/fleet/v4 (Go): upgrade to 4.81.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27806 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-27806?
Check whether you run Fleet Device Management Orbit or github.com/fleetdm/fleet/v4 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/fleetdm/fleet/v4 (Go): upgrade to 4.81.1 or later
    go get github.com/fleetdm/fleet/v4@v4.81.1

Technical details

A command injection vulnerability exists in the Fleet Orbit agent's FileVault disk encryption key rotation flow. The agent collects a user's password via a GUI and interpolates it into a Tcl/expect script using brace-quoted syntax: 'send {%s}'. An attacker can provide a password containing a closing brace '}' to terminate the literal string and inject arbitrary Tcl commands. Because the Orbit agent executes these scripts with root privileges via 'exec.Command', a local unprivileged user can achieve full privilege escalation. This issue is fixed in version 4.81.1.

Affected products

  • Fleet Device Management (fleetdm) Fleet Orbit agent < 4.81.1

Identifiers

  • CVE-2026-27806
  • GHSA-rphv-h674-5hp2
  • GO-2026-5634

Timeline

  • 2026-04-08: advisory
  • 2026-04-08: disclosed
  • 2026-04-08: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.