Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit

An unprivileged local user can exploit this vulnerability to gain root access to the system. This allows them to execute arbitrary commands with the highest privileges, potentially compromising the entire Fleet server and any managed devices. The attacker could modify system configurations, steal sensitive data, install malware, or disrupt services. The impact is particularly severe in environments where Fleet manages critical infrastructure or sensitive data.

1. Reserviert2026-02-24
2. Veröffentlicht2026-04-08
3. Geändert2026-04-09
4. EPSS aktualisiert2026-04-16

The primary mitigation is to upgrade Fleet to version 4.81.1 or later. If upgrading is not immediately possible, consider restricting access to the FileVault key rotation flow to trusted users only. Implement strict input validation and sanitization to prevent command injection. Monitor system logs for suspicious activity related to the FileVault key rotation process. After upgrading, confirm the fix by attempting to exploit the vulnerability; the injection should be blocked.