Public February 2026
Fleet Orbit Turned a Password Prompt into Root-Level Tcl Injection
BugBunny.ai found a local privilege-escalation bug in Fleet Orbit’s FileVault key rotation flow. Orbit collected a user password through a GUI dialog, interpolated it straight into an expect script, and then executed that script as root.
TL;DR
A local unprivileged user can escalate to root on a managed endpoint.
A password containing Tcl metacharacters supplied during FileVault key rotation.
Fleet Orbit releases before 4.81.1 on macOS endpoints using the key-rotation flow.
CVE assigned during coordination; fixed in Fleet 4.81.1.
Root Cause
Orbit generated a Tcl/expect script containing send {%s} and substituted the local password directly into that brace-quoted string. In Tcl, a closing brace ends the literal, so a password containing } could terminate the value and inject new Tcl commands.
The script was launched through exec.Command("expect", "-c", script) while Orbit itself ran as root. That elevated a local input-handling bug into full root command execution for any user who could trigger the FileVault rotation flow.
Product
Fleet Orbit
Affected
<4.81.1
Patched
>= 4.81.1
Weaknesses
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-94: Improper Control of Generation of Code ('Code Injection')
Mitigation
- Upgrade Fleet/Orbit to 4.81.1 or later.
- Do not embed secrets into Tcl or shell snippets without strict escaping or argument passing.
- Review local privilege boundaries around endpoint management workflows that mix UI prompts with privileged command execution.
Credits & Disclosure
CVE-2026-27806 was assigned during coordinated disclosure based on GitHub Security Advisory GHSA-rphv-h674-5hp2.