---
id: CVE-2026-27806
title: Fleet is open source device management software
summary: >-
  Fleet is open source device management software. Prior to 4.81.1, the Orbit
  agent's FileVault disk encryption key rotation flow on collects a local user's
  password via a GUI dialog and interpolates it directly into a Tcl/expect
  script ex…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-78
vendor: fleetdm
product: fleet
affected:
  - fleet < 4.81.1
patched:
  - fleet 4.81.1
published: '2026-04-08'
updated: '2026-07-25'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-27806'
references:
  - url: 'https://github.com/fleetdm/fleet/security/advisories/GHSA-rphv-h674-5hp2'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00114
epssPercentile: 0.01334
ingestedAt: '2026-07-26T10:11:58.416Z'
---

## Overview

Fleet is open source device management software. Prior to 4.81.1, the Orbit agent's FileVault disk encryption key rotation flow on collects a local user's password via a GUI dialog and interpolates it directly into a Tcl/expect script executed via exec.Command("expect", "-c", script). Because the password is inserted into Tcl brace-quoted send {%s}, a password containing } terminates the literal and injects arbitrary Tcl commands. Since Orbit runs as root, this allows a local unprivileged user to escalate to root privileges. This vulnerability is fixed in 4.81.1.

## Affected

- `fleet < 4.81.1`

## Remediation

Upgrade past the affected range:

- `fleet 4.81.1`