Executive brief
Fleet is an open-source tool used by organizations to manage and secure their fleet of laptops and servers. A security flaw in the Orbit agent component allows a local user on a managed computer to gain full administrative (root) control over that device. This occurs because the software does not properly handle certain characters in passwords during the disk encryption setup process, allowing a malicious user to trick the system into running unauthorized commands.
Technical details
A command injection vulnerability exists in the Fleet Orbit agent's FileVault disk encryption key rotation flow. The agent collects a user's password via a GUI and interpolates it into a Tcl/expect script using brace-quoted syntax: 'send {%s}'. An attacker can provide a password containing a closing brace '}' to terminate the literal string and inject arbitrary Tcl commands. Because the Orbit agent executes these scripts with root privileges via 'exec.Command', a local unprivileged user can achieve full privilege escalation. This issue is fixed in version 4.81.1.
Affected products
- Fleet Device Management (fleetdm) Fleet Orbit agent < 4.81.1
Timeline
- 2026-04-08: advisory
- 2026-04-08: disclosed
- 2026-04-08: patched