CVE-2026-101045
Received Received - Intake

Command Injection in Fleet-maintained macOS App Scripts

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulnCheck

Description
Fleet-maintained app install and uninstall scripts for macOS are generated from Homebrew cask metadata. In manifests generated before 2026-08-19, the script generator escaped this metadata at some interpolation sites but not all of them, so cask metadata containing shell metacharacters (for example $(...) command substitution) could be carried into scripts that execute as root on managed macOS hosts. An attacker who could land crafted metadata in an upstream Homebrew cask — without needing any Fleet credentials — could achieve arbitrary command execution as root on managed macOS hosts that install or uninstall the affected Fleet-maintained app; exploitation required the crafted metadata to pass both upstream Homebrew cask review and Fleet's review of the automated ingestion pull request. The fix (fleetdm/fleet#51324) landed in Fleet's ingestion pipeline on 2026-08-19 so that all manifests generated on or after that date escape cask metadata at every interpolation site; because manifests are generated centrally and distributed as pre-built content, remediation applied to all deployments with no customer action, and the code fix is included in Fleet v4.92.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-101045
EUVD
EUVD-2026-87976

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
fleetdm fleet 4.92.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-101045 is an OS command injection flaw in Fleet Homebrew Cask for macOS. Before August 19, 2026, Fleet's script generator did not fully escape shell metacharacters in Homebrew cask metadata. This allowed attackers to inject malicious commands into app install/uninstall scripts that run as root on managed macOS hosts. Exploitation required crafting metadata that bypassed both Homebrew and Fleet's review processes.

The vulnerability was fixed by ensuring all metadata is properly escaped in generated scripts starting August 19, 2026. The fix applies to all deployments automatically and is included in Fleet v4.92.0.

Detection Guidance

This vulnerability was fixed in Fleet's ingestion pipeline on 2026-08-19, so detection is only necessary if you are running versions prior to Fleet v4.92.0. Check your Fleet version with 'fleetctl version' and verify if it is older than v4.92.0. If so, inspect Homebrew cask metadata for shell metacharacters like $(...) in scripts generated before 2026-08-19.

Impact Analysis

If exploited, this vulnerability allows attackers to execute arbitrary commands with root privileges on managed macOS hosts. This could lead to complete system compromise, data theft, or unauthorized modifications. The attack requires passing both Homebrew and Fleet's review, making real-world exploitation unlikely.

Compliance Impact

This vulnerability could lead to unauthorized root access, potentially violating compliance requirements for data protection (GDPR) and healthcare data (HIPAA) by enabling data breaches or system tampering. The high-impact nature of root-level access makes it a significant compliance risk.

Mitigation Strategies

Upgrade to Fleet v4.92.0 or later. The fix is included in this version and retroactively applies to all deployments without additional action. No manual remediation is required as the fix was applied centrally in the ingestion pipeline on 2026-08-19.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101045. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart