Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/fleetdm/fleet

4 known vulnerabilities (1 critical, 1 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 1 critical, 1 high, 2 medium
Registry
pkg.go.dev

Advisories 4

  • Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database

    Affected: fixed in 4.86.2.

  • CVE-2026-23518Critical 9.3

    Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment

    Affected: from 4.78.0, fixed in 4.78.3; from 4.77.0, fixed in 4.77.1; from 4.76.0, fixed in 4.76.2; from 4.75.0, fixed in 4.75.2; fixed in 4.43.5-0.20260112202845-e225ef57912c.

  • CVE-2026-23517Medium 6.3

    Fleet has an Access Control vulnerability in debug/pprof endpoints

    Affected: from 4.78.0, fixed in 4.78.3; from 4.77.0, fixed in 4.77.1; from 4.76.0, fixed in 4.76.2; from 4.75.0, fixed in 4.75.2.

  • CVE-2026-22808Medium 5.5

    Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability

    Affected: from 4.78.0, fixed in 4.78.2; from 4.77.0, fixed in 4.77.1; from 4.76.0, fixed in 4.76.2; from 4.75.0, fixed in 4.75.2.