Cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3afleetdmfleet/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 27 Sep 2026 19:09:05 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCommand Injection in Fleet macOS App Manifest Generation (CVE-2026-101045)https://feed.craftedsignal.io/briefs/2026-09-cve-2026-101045/Sun, 27 Sep 2026 19:09:05 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-cve-2026-101045/An improper sanitization vulnerability in Fleet's macOS app install/uninstall script generator allowed arbitrary command execution as root via malicious Homebrew cask metadata.CVE-2026-101045 identifies a security vulnerability in the Fleet management platform's ingestion pipeline for macOS application manifests. Prior to 2026-08-19, the script generator responsible for creating install and uninstall scripts from Homebrew cask metadata failed to correctly escape shell metacharacters at all interpolation sites. This deficiency allowed an attacker capable of submitting crafted metadata to an upstream Homebrew cask to trigger arbitrary command execution as root on managed macOS hosts when the specific app was installed or uninstalled.

Remediation was implemented centrally in the ingestion pipeline on 2026-08-19, ensuring that all metadata is properly escaped. The fix is formally included in Fleet v4.92.0. As Fleet generates these manifests centrally and distributes them as pre-built content, no customer action was required to remediate existing environments. This vulnerability underscores the risk of automated script generation pipelines processing untrusted third-party metadata.

Impact

Successful exploitation results in arbitrary code execution with root privileges on any macOS endpoint managed by an affected Fleet installation that processes the malicious manifest. This could lead to full system compromise, exfiltration of sensitive data, or the deployment of persistent malicious agents across the managed macOS fleet.

Recommendation

  • Verify all Fleet instances are running v4.92.0 or later to ensure the patch is present in the local binary.
  • Review audit logs for any unexpected process executions originating from the Fleet agent or installer scripts on managed macOS endpoints.
  • Monitor macOS process creation logs for the execution of unexpected commands following the deployment of new or updated software packages via Fleet.
]]>highadvisoryvulnerabilitycommand-injectionmacosfleet