CVE-2026-101045

Executive Summary

CVE-2026-101045 is a command injection vulnerability (CWE-78) in Fleet's generation of install and uninstall scripts for macOS apps, where cask metadata derived from Homebrew was interpolated into shell scripts without escaping at every interpolation site. Because these generated scripts execute as root on managed macOS hosts when an administrator installs or uninstalls the affected Fleet-maintained app, crafted metadata in an upstream Homebrew cask could result in arbitrary command execution as root. The issue was fixed centrally in Fleet's ingestion pipeline on 2026-08-19 (fleetdm/fleet#51324, shipped in Fleet v4.92.0); remediation applied to all deployments with no customer action because manifests are generated centrally and distributed as pre-built content.

Technical Analysis

Fleet maintains app install and uninstall scripts for macOS generated from Homebrew cask metadata. In manifests generated before 2026-08-19, the script generator escaped this metadata at some interpolation sites but not all of them. As a result, cask metadata containing shell metacharacters — for example $(...) command substitution — could be carried into the generated scripts.

The generated install/uninstall scripts execute as root on managed macOS hosts. Any unescaped metacharacter reaching an unsanitized interpolation site is therefore evaluated by the root shell executing the script, yielding arbitrary command execution at root privilege. This maps directly to CWE-78 (Improper Neutralization of Special Elements used in an OS Command / OS Command Injection).

Two properties distinguish this flaw from a conventional remote code execution vulnerability:

• Attack surface is the supply chain, not the Fleet control plane. The attacker does not need Fleet credentials. The injection point is upstream cask metadata; the payload is carried into Fleet's perimeter through the normal ingestion path and then into centrally generated content distributed to managed hosts.
• The affected artifact is generated content, not shipped binary code. Manifests are produced by Fleet's ingestion pipeline and distributed as pre-built content, which is why the fix — applied in the pipeline on 2026-08-19 — remediated all deployments with no customer action.

Insufficient technical detail is available to name the specific unescaped interpolation sites, the exact fields of cask metadata that were not neutralized, or the precise generator functions involved; the NVD description does not enumerate them. The vulnerability class is unambiguous, however: shell metacharacters from a semi-trusted upstream source reached a root-privileged shell script without complete escaping.

The CVSS vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H (8.0 High) is consistent with this analysis. Attack vector Network (AV:N) reflects the upstream-supplied metadata path. High attack complexity (AC:H) and High privileges required (PR:H) reflect the two independent review gates the crafted metadata had to pass — upstream Homebrew cask review and Fleet's review of the automated ingestion pull request. Scope Changed (S:C) captures that the vulnerable component (Fleet's ingestion/script-generation pipeline) impacts a component with different security authority: root execution on managed macOS endpoints. Confidentiality, Integrity, and Availability are all High (C:H/I:H/A:H).

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description, and is constrained to details that description supports.

1. Reconnaissance / target identification. The attacker identifies Fleet-managed macOS deployments that install a targeted Fleet-maintained app. Cask-based deployment content is public by nature, so the attacker can infer which apps are delivered this way without any Fleet access. No credentials are required at this stage.

2. Payload placement in upstream metadata. The attacker attempts to land a crafted Homebrew cask whose metadata contains shell metacharacters — for example a command substitution $(...) embedded in a metadata field. This is the step that makes the attack hard (AC:H): the crafted metadata must pass upstream Homebrew cask review before it can ever reach Fleet's ingestion path.

3. Ingestion and generation. Once the crafted cask is accepted upstream, Fleet's automated ingestion pipeline pulls the cask metadata and generates the Fleet-maintained app install/uninstall scripts. In manifests generated before 2026-08-19, metadata was escaped at some interpolation sites but not all, so a metacharacter reaching an unescaped site is carried verbatim into the generated script. The second review gate (AC:H, PR:H) is Fleet's review of the automated ingestion pull request; the crafted metadata must also pass this review.

4. Execution as root on managed hosts. The centrally generated manifest is distributed as pre-built content to managed macOS hosts. When the affected Fleet-maintained app is installed or uninstalled, the generated script runs as root and the embedded metacharacter is evaluated — command substitution executes the attacker's command with root privilege. Because UI is None (UI:N), no further victim interaction beyond the install/uninstall operation is modeled in the CVSS vector, though the script only executes in the context of that install or uninstall action.

5. Post-exploitation impact. Successful execution yields arbitrary command execution as root on every managed macOS host that installs or uninstalls the affected app (Scope Changed). At root, the attacker can read and exfiltrate sensitive data (C:H), modify system state, install persistence, or deploy further tooling (I:H), and disrupt endpoint availability (A:H). The compromised artifact is centrally distributed, so blast radius scales with the number of managed hosts that install or uninstall the affected app, not with the number of attacker attempts.

The principal practical mitigation to observe is that the payload is only effective at the moment the generated script is evaluated. Manifests generated on or after 2026-08-19 escape metadata at every interpolation site, neutralizing this class of payload for content regenerated after the fix.

Impact Assessment

Successful exploitation results in arbitrary command execution as root on managed macOS hosts that install or uninstall the affected Fleet-maintained app. Per the CVSS subscores:

• Confidentiality: High. Root-level access to managed endpoints exposes local secrets, credentials, configuration, and any data reachable with root privilege.
• Integrity: High. Root access permits modification of system files, configuration, and installed software, and enables persistence.
• Availability: High. Root access permits destructive actions against the endpoint, including disabling security controls or rendering the host unusable.
• Scope: Changed. The vulnerable pipeline (Fleet's central ingestion and script generation) affects assets under different security authority — root on distributed managed endpoints — which is why the base score is elevated despite High attack complexity and High privileges required.
• Attack Vector: Network / UI: None. The crafted metadata is delivered via the upstream ingestion path and executed in the context of a normal install/uninstall operation, with no additional user interaction modeled.

Blast radius is a function of deployment scale: because the manifest is generated centrally and distributed as pre-built content, a single poisoned cask that passes both review gates reaches every managed macOS host that installs or uninstalls that app. Mitigating factors are the two mandatory review gates (upstream Homebrew cask review and Fleet's review of the automated ingestion PR), which substantially raise the bar for landing malicious metadata, and the absence — at time of writing — of any public PoC, Nuclei template, exploit code, or CISA KEV listing. EPSS has not been scored by FIRST.org; no EPSS value should be cited. CISA KEV: NO.

Detection Guidance

Detection should focus on the generated script content and on root-shell execution of install/uninstall scripts on managed macOS hosts, since the injection point (upstream cask metadata) is outside the defender's control but the generated manifest and its root execution are observable on the endpoint.

Sigma Rule

title: Suspicious Command Substitution in Fleet-Generated macOS App Install/Uninstall Scripts
id: 8f3c1a72-4d5e-4b91-9a06-7c2e5f0b1d84
status: experimental
description: Detects command substitution and shell metacharacters in Fleet-generated Homebrew cask install/uninstall scripts executed as root on macOS hosts, consistent with CVE-2026-101045.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101045
author: valtersit.com
date: 2026-08-19
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  product: macos
  category: process_creation
detection:
  selection_script:
    Image|endswith:
      - '/bin/sh'
      - '/bin/bash'
      - '/bin/zsh'
  selection_content:
    CommandLine|contains:
      - '$(('
      - '`'
      - '${IFS}'
      - ';curl '
      - '|sh'
      - '| sh'
      - '|bash'
      - '| bash'
  selection_parent:
    ParentImage|contains:
      - 'fleet'
      - 'Fleet'
  condition: selection_script and selection_content and selection_parent
falsepositives:
  - Legitimate install scripts that conditionally invoke helper tools
level: high

YARA Rule

rule CVE_2026_101045_Fleet_Cask_Metadata_Injection
{
    meta:
        description = "Detects Fleet-generated macOS app install/uninstall manifests carrying unescaped shell metacharacters from Homebrew cask metadata (CVE-2026-101045)"
        author = "valtersit.com"
        date = "2026-08-19"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101045"
        severity = "high"

    strings:
        $install = "install" ascii wide nocase
        $uninstall = "uninstall" ascii wide nocase
        $cask = "cask" ascii wide nocase
        $homebrew = "homebrew" ascii wide nocase
        $cmdsub = "$(" ascii
        $backtick = "`" ascii
        $curl = "curl " ascii
        $pipe_sh = "| sh" ascii
        $pipe_bash = "| bash" ascii
        $ifs = "${IFS}" ascii

    condition:
        (uint32(0) == 0x464C457F or uint32(0) == 0x7B20220A or true) and
        (any of ($install, $uninstall, $cask, $homebrew)) and
        (any of ($cmdsub, $backtick, $curl, $pipe_sh, $pipe_bash, $ifs))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-101045 Fleet Homebrew Cask Metadata Command Substitution in Ingestion"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"cask"; nocase; http.request_body; content:"$("; http.request_body; content:"install"; nocase; reference:cve,2026-101045; classtype:attempted-admin; sid:2026101045; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.name in ("sh", "bash", "zsh") and
  process.parent.name : ("fleet*", "Fleet*") and
  (process.command_line : "*$(*" or process.command_line : "*`*" or
   process.command_line : "*${IFS}*" or process.command_line : "*| sh*" or
   process.command_line : "*| bash*")

Splunk SPL Query

index=endpoint sourcetype=macos_unified_log OR sourcetype=osquery
(process_name IN ("sh","bash","zsh") AND parent_process_name IN ("fleet","fleetd","Fleet"))
AND (command_line="*$(*" OR command_line="*`*" OR command_line="*${IFS}*" OR command_line="*| sh*" OR command_line="*| bash*")
| stats count min(_time) as first_seen max(_time) as last_seen values(command_line) as commands by host, user, parent_process_name
| where user="root"
| sort - count

Wazuh OSSEC Rule

<group name="macos,fleet,cve-2026-101045,">
  <rule id="101045" level="12">
    <decoded_as>json</decoded_as>
    <field name="process.name">^(\/bin\/)?(sh|bash|zsh)$</field>
    <field name="process.parent.name">fleet</field>
    <field name="process.command_line">\$\(|\`|\$\{IFS\}|\| *(sh|bash)</field>
    <description>CVE-2026-101045: Possible command injection in Fleet-generated macOS app install/uninstall script executed as root</description>
    <mitre>
      <id>T1059.004</id>
    </mitre>
    <group>attack.execution,pci_dss_10.2.2,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Note that the upstream project states the defect was remediated centrally in the ingestion pipeline on 2026-08-19 and that the code fix is included in Fleet v4.92.0.

1) Immediate mitigations

• Treat any manifest generated before 2026-08-19 as untrusted content. Do not run install/uninstall operations for affected Fleet-maintained apps until the manifest has been regenerated from the fixed pipeline.
• Because manifests are generated centrally and distributed as pre-built content, remediation for the ingestion pipeline applied to all deployments with no customer action. Verify that the manifests currently in use were generated on or after 2026-08-19.
• Where verification is not possible, inspect generated install/uninstall scripts for shell metacharacters — in particular command substitution $(...) — in regions populated from Homebrew cask metadata, and treat any occurrence as presumptively malicious.
• Restrict who can trigger app installs/uninstalls on managed macOS hosts as a containment measure, reducing the number of endpoints on which a poisoned manifest could be evaluated.

2) Patch / upgrade steps

• Upgrade the Fleet server deployment to Fleet v4.92.0 or later, which contains the code fix (fleetdm/fleet#51324).
• Confirm that all manifests in use were regenerated on or after 2026-08-19, so that cask metadata is escaped at every interpolation site.
• Re-verify the integrity and provenance of any Fleet-maintained app manifest that predates 2026-08-19 and was actually used to install or uninstall software.

3) Long-term hardening

• Treat upstream package-manager metadata (Homebrew casks in this case) as untrusted input and enforce escaping at every interpolation site as a code-level invariant, with tests covering metacharacter payloads.
• Prefer passing metadata as arguments or structured data rather than interpolating it into shell text, avoiding the shell parser entirely for untrusted values.
• Maintain a review gate pairing automated ingestion PRs with human review for third-party metadata, since in this case both upstream cask review and Fleet ingestion review were the primary barriers to exploitation.
• Retain audit logging of which manifest version was applied to which host, to support retroactive scoping if a poisoned manifest is later identified.

References

• NVD — CVE-2026-101045: https://nvd.nist.gov/vuln/detail/CVE-2026-101045
• Fleet (fleetdm/fleet) — upstream fix for the ingestion pipeline, PR #51324 (2026-08-19), included in Fleet v4.92.0
• CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): https://cwe.mitre.org/data/definitions/78.html
• MITRE ATT&CK T1059 — Command and Scripting Interpreter: https://attack.mitre.org/techniques/T1059/
• CISA Known Exploited Vulnerabilities Catalog — no listing for CVE-2026-101045 at time of writing

No public PoC, exploit code, Nuclei template, or exploit-in-the-wild evidence is available for CVE-2026-101045, and no threat actor campaign has been associated with it. EPSS has not yet been scored by FIRST.org.