En resumen
- CVE-2026-27806 es una vulnerabilidad ALTO (CVSS 7.8) que afecta a github.com/fleetdm/fleet/v4, fleet (fleetdm).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.11%, mayor que el 1.3% de las vulnerabilidades.
- Solución: actualizar a 4.81.1 o posterior.
Description
Summary
The Orbit agent's FileVault disk encryption key rotation flow on collects a local user's password via a GUI dialog and interpolates it directly into a Tcl/expect script executed via exec.Command("expect", "-c", script). Because the password is inserted into Tcl brace-quoted send {%s}, a password containing } terminates the literal and injects arbitrary Tcl commands. Since Orbit runs as root, this allows a local unprivileged user to escalate to root privileges.
CWE
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- CWE-94: Improper Control of Generation of Code ('Code Injection')
Impact
- Local privilege escalation to root: Any unprivileged local user on a managed endpoint can execute arbitrary commands as root
Credit
This vulnerability was discovered and reported by bugbunny.ai.
NVD description
Fleet is open source device management software. Prior to 4.81.1, the Orbit agent's FileVault disk encryption key rotation flow on collects a local user's password via a GUI dialog and interpolates it directly into a Tcl/expect script executed via exec.Command("expect", "-c", script). Because the password is inserted into Tcl brace-quoted send {%s}, a password containing } terminates the literal and injects arbitrary Tcl commands. Since Orbit runs as root, this allows a local unprivileged user to escalate to root privileges. This vulnerability is fixed in 4.81.1.
Más vulnerabilidades de github.com/fleetdm/fleet/v4
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free