Fleetdm Fleet vulnerabilities

CVE-2026-23518 [CRITICAL] CWE-347 CVE-2026-23518: Fleet is open source device management software. In versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2 Fleet is open source device management software. In versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3, a vulnerability in Fleet's Windows MDM enrollment flow could allow an attacker to submit forged authentication tokens that are not properly validated. Because JWT signatures were not verified, Fleet could accept attacker-controlled ide

CVE-2026-34387 [CRITICAL] CWE-78 CVE-2026-34387: Fleet is open source device management software. Prior to 4.81.1, a command injection vulnerability Fleet is open source device management software. Prior to 4.81.1, a command injection vulnerability in Fleet's software installer pipeline allows an attacker to achieve arbitrary code execution as root (macOS/Linux) or SYSTEM (Windows) on managed hosts when an uninstall is triggered for a crafted software package. Version 4.81.1 patches the issue.

CVE-2026-103264 [CRITICAL] CWE-287 CVE-2026-103264: Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that a Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS hosts to read device data and trigger device-scoped

CVE-2026-26191 [CRITICAL] CWE-78 CVE-2026-26191: Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet's Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet's software installer pipeline could allow a crafted software package to execute arbitrary commands as root (macOS/Linux) or SYSTEM (Windows) on managed endpoints when an uninstall is triggered. When a software package (.pkg, .deb, .rpm, .exe, or .msi)

CVE-2026-26060 [HIGH] CWE-613 CVE-2026-26060: Fleet is open source device management software. Prior to 4.81.0, a vulnerability in Fleet’s passwor Fleet is open source device management software. Prior to 4.81.0, a vulnerability in Fleet’s password management logic could allow previously issued password reset tokens to remain valid after a user changes their password. As a result, a stale password reset token could be reused to reset the account password even after a defensive password change. V

CVE-2026-29180 [HIGH] CWE-862 CVE-2026-29180: Fleet is open source device management software. Prior to 4.81.1, a broken access control vulnerabil Fleet is open source device management software. Prior to 4.81.1, a broken access control vulnerability in Fleet's host transfer API allows a team maintainer to transfer hosts from any team into their own team, bypassing team isolation boundaries. Once transferred, the attacker gains full control over the stolen hosts, including the ability to execute

CVE-2026-26186 [HIGH] CWE-89 CVE-2026-26186: Fleet is open source device management software. A SQL injection vulnerability in versions prior to Fleet is open source device management software. A SQL injection vulnerability in versions prior to 4.80.1 allowed authenticated users to inject arbitrary SQL expressions via the `order_key` query parameter. Due to unsafe use of `goqu.I()` when constructing the `ORDER BY` clause, specially crafted input could escape identifier quoting and be interpreted

CVE-2026-54245 [HIGH] CWE-89 CVE-2026-54245: Fleet is an open-source device management platform built on osquery. In versions prior to 4.86.2, th Fleet is an open-source device management platform built on osquery. In versions prior to 4.86.2, the Okta conditional access integration in Fleet Premium is vulnerable to SQL injection through a host-supplied value that is used in a database query without proper parameterization, allowing an attacker who controls a single enrolled host to read or modi

CVE-2026-34386 [HIGH] CWE-89 CVE-2026-34386: Fleet is open source device management software. Prior to 4.81.0, a SQL injection vulnerability in F Fleet is open source device management software. Prior to 4.81.0, a SQL injection vulnerability in Fleet's MDM bootstrap package configuration allows an authenticated user with Team Admin or Global Admin privileges to modify arbitrary team configurations, exfiltrate sensitive data from the Fleet database, and inject arbitrary content into team configs

CVE-2025-27509 [CRITICAL] CWE-285 CVE-2025-27509: fleetdm/fleet is an open source device management, built on osquery. In vulnerable versions of Fleet fleetdm/fleet is an open source device management, built on osquery. In vulnerable versions of Fleet, an attacker could craft a specially-formed SAML response to forge authentication assertions, provision a new administrative user account if Just-In-Time (JIT) provisioning is enabled, or create new accounts tied to forged assertions if f MDM enrol

CVE-2020-26276 [CRITICAL] CWE-290 CVE-2020-26276: Fleet is an open source osquery manager. In Fleet before version 3.5.1, due to issues in Go's standa Fleet is an open source osquery manager. In Fleet before version 3.5.1, due to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from a SAML IdP. Users that configure Fleet with SSO login may be vulnerable to this issue. Thi

CVE-2026-34385 [HIGH] CWE-89 CVE-2026-34385: Fleet is open source device management software. Prior to 4.81.0, a second-order SQL injection vulne Fleet is open source device management software. Prior to 4.81.0, a second-order SQL injection vulnerability in Fleet's Apple MDM profile delivery pipeline could allow an attacker with a valid MDM enrollment certificate to exfiltrate or modify the contents of the Fleet database, including user credentials, API tokens, and device enrollment secrets. Ver

CVE-2026-24899 [HIGH] CWE-290 CVE-2026-24899: Fleet is open source device management software. Prior to version 4.82.0, a vulnerability in Fleet's Fleet is open source device management software. Prior to version 4.82.0, a vulnerability in Fleet's Windows MDM enrollment flow allows authentication tokens from any Azure AD tenant to be accepted. Because Fleet validates JWT signatures using Microsoft's multi-tenant JWKS endpoint but does not enforce the `aud` (audience) or `iss` (issuer) claims, an

CVE-2026-46356 [HIGH] CWE-290 CVE-2026-46356: Fleet is open source device management software. Prior to version 4.80.1, a vulnerability in Fleet's Fleet is open source device management software. Prior to version 4.80.1, a vulnerability in Fleet's IP extraction logic allows unauthenticated attackers to bypass API rate limiting by spoofing client IP headers. This may allow brute-force login attempts or other abuse against Fleet instances exposed to the public internet. Fleet extracted client IP a

CVE-2026-101045 [HIGH] CWE-78 CVE-2026-101045: Fleet-maintained app install and uninstall scripts for macOS are generated from Homebrew cask metada Fleet-maintained app install and uninstall scripts for macOS are generated from Homebrew cask metadata. In manifests generated before 2026-08-19, the script generator escaped this metadata at some interpolation sites but not all of them, so cask metadata containing shell metacharacters (for example $(...) command substitution) could be carried into s

CVE-2026-23517 [HIGH] CWE-862 CVE-2026-23517: Fleet is open source device management software. A broken access control issue in versions prior to Fleet is open source device management software. A broken access control issue in versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 allowed authenticated users to access debug and profiling endpoints regardless of role. As a result, low-privilege users could view internal server diagnostics and trigger resource-intensive profiling operations

CVE-2026-34391 [HIGH] CWE-488 CVE-2026-34391: Fleet is open source device management software. Prior to 4.81.1, a vulnerability in Fleet's Windows Fleet is open source device management software. Prior to 4.81.1, a vulnerability in Fleet's Windows MDM command processing allows a malicious enrolled device to access MDM commands intended for other devices, potentially exposing sensitive configuration data such as WiFi credentials, VPN secrets, and certificate payloads across the entire Windows fle

CVE-2022-24841 [HIGH] CWE-284 CVE-2022-24841: fleetdm/fleet is an open source device management, built on osquery. All versions of fleet making us fleetdm/fleet is an open source device management, built on osquery. All versions of fleet making use of the teams feature are affected by this authorization bypass issue. Fleet instances without teams, or with teams but without restricted team accounts are not affected. In affected versions a team admin can erroneously add themselves as admin, mainta

CVE-2026-23998 [HIGH] CWE-295 CVE-2026-23998: Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet’s Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet’s Windows MDM management endpoint could allow requests to be processed without proper client certificate validation. In certain circumstances, this could allow an attacker to impersonate an enrolled Windows device and retrieve sensitive configuration dat

CVE-2026-26061 [HIGH] CWE-770 CVE-2026-26061: Fleet is open source device management software. Prior to 4.81.0, Fleet contained multiple unauthent Fleet is open source device management software. Prior to 4.81.0, Fleet contained multiple unauthenticated HTTP endpoints that read request bodies without enforcing a size limit. An unauthenticated attacker could exploit this behavior by sending large or repeated HTTP payloads, causing excessive memory allocation and resulting in a denial-of-service (