OS Command Injection via Homebrew Cask Metadata in Fleet (CVE-2026-26191)

Vulnerability Critical Information Summary Vulnerability Overview Vulnerability Name: OS command injection via Homebrew cask metadata in Fleet-maintained app install and uninstall scripts CVE ID: CVE-2026-26191, CVE-2026-34387 Severity: High (8.0/10) Vulnerability Type: OS command injection Description: The macOS application installation and uninstallation scripts maintained by Fleet are generated from Homebrew cask metadata. While the script generator escapes metadata in certain interpolation locations, it does not do so for all locations. Cask metadata containing shell metacharacters (such as command substitution) can be injected into scripts running with root privileges. Impact Scope Affected Software: Fleet-maintained app manifests (macOS) Affected Versions: Versions generated prior to August 19, 2026 Impact Description: An attacker can inject malicious metadata into non-official Homebrew casks to execute arbitrary commands with root privileges on managed macOS hosts. The attacker does not need Fleet credentials, but the malicious metadata must pass Homebrew cask review and Fleet's automated injection PR review. Remediation Remediation Version: Fleet v4.32.0 Remediation Date: August 19, 2026 Remediation Details: The fix is already included in Fleet's application ingestion pipeline. All generated manifests now escape every interpolation position in cask metadata. Since the affected manifests are generated centrally and distributed to Fleet servers, the fix takes effect for all Fleet deployments without requiring any customer action or server upgrades. Temporary Mitigations: None required. The fix takes effect during content generation in the Fleet pipeline, independent of the Fleet server version or deployment status. POC or Exploit Code Not Included in Page

Goal Reached Thanks to every supporter — we hit 100%!

OS Command Injection via Homebrew Cask Metadata in Fleet (CVE-2026-26191)

More from this source