Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-101045— Fleet Homebrew Cask OS Command Injection via Metadata

Quick assessment

Affected
fleetdm fleet
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

针对 macOS 的 Fleet 维护的应用程序安装和卸载脚本是根据 Homebrew Cask 元数据生成的。在 2026 年 8 月 19 日之前生成的清单中，脚本生成器仅在某些插值位置对元数据进行了转义，而并非全部。因此，如果 Cask 元数据中包含 shell 元字符（例如 $(...) 命令替换），这些内容可能会带入在受管 macOS 主机上以 root 权限执行的脚本中。 攻击者若能在上游 Homebrew Cask 中植入精心构造的元数据（无需任何 Fleet 凭据），即可在安装了受影响应用程序（安装

CVSS 8.0 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-101045

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Fleet Homebrew Cask OS Command Injection via Metadata
Source: CVE Program / CVE List V5
Vulnerability Description
Fleet-maintained app install and uninstall scripts for macOS are generated from Homebrew cask metadata. In manifests generated before 2026-08-19, the script generator escaped this metadata at some interpolation sites but not all of them, so cask metadata containing shell metacharacters (for example $(...) command substitution) could be carried into scripts that execute as root on managed macOS hosts. An attacker who could land crafted metadata in an upstream Homebrew cask — without needing any Fleet credentials — could achieve arbitrary command execution as root on managed macOS hosts that install or uninstall the affected Fleet-maintained app; exploitation required the crafted metadata to pass both upstream Homebrew cask review and Fleet's review of the automated ingestion pull request. The fix (fleetdm/fleet#51324) landed in Fleet's ingestion pipeline on 2026-08-19 so that all manifests generated on or after that date escape cask metadata at every interpolation site; because manifests are generated centrally and distributed as pre-built content, remediation applied to all deployments with no customer action, and the code fix is included in Fleet v4.92.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
fleetdm fleet - -

II. Public POCs for CVE-2026-101045

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-101045

请登录查看更多情报信息。

Other References for CVE-2026-101045 (2)

Same Patch Batch · fleetdm · 2026-09-27 · 3 CVEs total

CVE-2026-101047 5.3 MEDIUM Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs
CVE-2026-101046 3.1 LOW Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints

IV. Related Vulnerabilities

Same product: fleet
Same vendor: fleetdm
Same weakness: CWE-78

V. Comments for CVE-2026-101045

No comments yet

Leave a comment