CVE-2026-27806High· 7.8▾ TwilightFleet is open source device management software. Prior to 4.81.1, the Orbit agent's FileVault disk encryption key rotation flow on collects a local user's password via a GUI dialog and interpolates it directly into a Tcl/expect script ex…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.1%
0.1% → 0.1%
Fleet is open source device management software. Prior to 4.81.1, the Orbit agent's FileVault disk encryption key rotation flow on collects a local user's password via a GUI dialog and interpolates it directly into a Tcl/expect script executed via exec.Command("expect", "-c", script). Because the password is inserted into Tcl brace-quoted send {%s}, a password containing } terminates the literal and injects arbitrary Tcl commands. Since Orbit runs as root, this allows a local unprivileged user to escalate to root privileges. This vulnerability is fixed in 4.81.1.
fleet < 4.81.1Upgrade past the affected range:
fleet 4.81.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-101045High· 8.0Fleet-maintained app install and uninstall scripts for macOS are generated from Homebrew cask metadata
CVE-2026-111923High· 7.5Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing
CVE-2026-111924High· 7.5Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression
CVE-2021-21296Low· 2.7Fleet is an open source osquery manager
CVE-2026-103264Critical· 9.1Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs
CVE-2026-103265Medium· 4.3Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results endpoint