Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/fleetdm/fleet/v4

32 known vulnerabilities (3 critical, 6 high, 18 medium, 5 low), with the versions each affects and the releases that fix them.

Latest release
v4.43.4 (Jan 25, 2024): affected by 29 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
32 · 3 critical, 6 high, 18 medium, 5 low
Releases
5 since v4.0.0 (Jun 29, 2021)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Show all 32 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 32

  • CVE-2026-101047Medium 6.9

    Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs

    Affected: fixed in 4.87.0.

    No fix released. The advisory names 4.87.0 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected.

  • Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints

    Affected: fixed in 4.89.0.

    No fix released. The advisory names 4.89.0 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected.

  • Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database

    Affected: fixed in 4.86.2.

    No fix released. The advisory names 4.86.2 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected.

  • CVE-2026-46371Medium 6.5

    Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint

    Affected: fixed in 4.84.2.

    No fix released. The advisory names 4.84.2 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected.

  • CVE-2026-46370Medium 6.5

    Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint

    Affected: fixed in 4.84.2.

    No fix released. The advisory names 4.84.2 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected.

  • CVE-2026-41262Medium 4.3

    Fleet: Cross-Team Policy Data Exposure via Global Policy Read Endpoint

    Affected: fixed in 4.85.0.

    No fix released. The advisory names 4.85.0 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected.

  • CVE-2026-48786Medium 6.5

    Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint

    Affected: fixed in 4.87.0.

    No fix released. The advisory names 4.87.0 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected.

  • CVE-2026-46356Medium 6.9

    Fleet: IP spoofing allows bypassing API rate limiting

    Affected: fixed in 4.80.1.

    No fix released. The advisory names 4.80.1 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected.

  • CVE-2026-26191Medium 6.0

    Fleet vulnerable to OS command injection in software packages

    Affected: fixed in 4.81.1.

    No fix released. The advisory names 4.81.1 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected.

  • Fleet server may terminate unexpectedly when handling certain gRPC requests

    Affected: fixed in 4.81.0.

    No fix released. The advisory names 4.81.0 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected.

  • Fleet Windows MDM Azure AD JWT Authentication Bypass

    Affected: fixed in 4.82.0.

    No fix released. The advisory names 4.82.0 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected.

  • CVE-2026-24000Medium 6.9

    Fleet has a rate limiting bypass via untrusted client IP headers

    Affected: fixed in 4.80.1.

    No fix released. The advisory names 4.80.1 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected.

  • Fleet has a Windows MDM management endpoint authentication bypass

    Affected: fixed in 4.81.0.

    No fix released. The advisory names 4.81.0 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected.

  • Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit

    Affected: fixed in 4.81.1.

    No fix released. The advisory names 4.81.1 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected.

  • CVE-2026-34389Medium 4.9

    Fleet's user account creation via invite does not enforce invited email address

    Affected: fixed in 4.81.0.

    No fix released. The advisory names 4.81.0 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected.

Show all 32 advisoriesShow fewer advisories
  • CVE-2026-34388Medium 6.6

    Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint

    Affected: fixed in 4.81.0.

    No fix released. The advisory names 4.81.0 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected.

  • CVE-2026-34386Medium 6.3

    Fleet vulnerable to SQL injection in MDM bootstrap package by authenticated team or global admin

    Affected: fixed in 4.81.0.

    No fix released. The advisory names 4.81.0 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected.

  • CVE-2026-34385Medium 6.2

    Fleet's Apple MDM profile delivery has second-order SQL injection that can compromise the database

    Affected: fixed in 4.81.0.

    No fix released. The advisory names 4.81.0 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected.

  • CVE-2026-29180Medium 4.9

    Fleet's team maintainer can transfer hosts from any team via missing source team authorization

    Affected: fixed in 4.81.1.

    No fix released. The advisory names 4.81.1 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected.

  • Fleet's unbounded request body read allows remote Denial of Service

    Affected: fixed in 4.43.5-0.20260113202849-bbc1aef2987d; all versions.

    No fix released. The latest release, v4.43.4, is still affected.

  • CVE-2026-26060Medium 6.0

    Fleet: Password reset tokens remain valid after password change for 24 hours

    Affected: all versions; fixed in 4.43.5-0.20260113202849-bbc1aef2987d.

    No fix released. The latest release, v4.43.4, is still affected.

  • Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users

    Affected: fixed in 4.80.1.

    No fix released. The advisory names 4.80.1 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected.

  • Fleet: Authorization Bypass in certificate template batch deletion for team administrators

    Affected: fixed in 4.80.1.

    No fix released. The advisory names 4.80.1 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected.

  • Fleet: Device lock PIN can be predicted if lock time is known

    Affected: fixed in 4.80.1.

    No fix released. The advisory names 4.80.1 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected.

  • Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint

    Affected: fixed in 4.80.1.

    No fix released. The advisory names 4.80.1 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected.

  • CVE-2026-26186Medium 5.1

    Fleet has a SQL injection via backtick escape in ORDER BY parameter

    Affected: fixed in 4.80.1.

    No fix released. The advisory names 4.80.1 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected.

  • CVE-2026-23518Critical 9.3

    Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment

    Affected: from 4.75.0, fixed in 4.75.2; from 4.76.0, fixed in 4.76.2; from 4.77.0, fixed in 4.77.1; from 4.78.0, fixed in 4.78.3.

    No fix released. The advisory names 4.75.2 and 4.76.2 and 4.77.1 and 4.78.3 as the fix, which the registry doesn't have yet.

  • CVE-2026-23517Medium 6.3

    Fleet has an Access Control vulnerability in debug/pprof endpoints

    Affected: fixed in 4.78.3-0.20260112221730-5c030e32a3a9; from 4.75.0, fixed in 4.75.2; from 4.76.0, fixed in 4.76.2; from 4.77.0, fixed in 4.77.1; from 4.78.0, fixed in 4.78.3.

    No fix released. The advisory names 4.78.3 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected.

  • CVE-2026-22808Medium 5.5

    Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability

    Affected: from 4.75.0, fixed in 4.75.2; from 4.76.0, fixed in 4.76.2; from 4.77.0, fixed in 4.77.1; from 4.78.0, fixed in 4.78.2; fixed in 4.43.5-0.20260111020427-0e6c790803d1.

    No fix released. The advisory names 4.43.5-0.20260111020427-0e6c790803d1 and 4.75.2 and 4.76.2 and 4.77.1 and 4.78.2 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected.

  • CVE-2025-27509Critical 9.3

    SAML authentication vulnerability due to improper SAML response validation

    Affected: all versions; from 4.64.0, fixed in 4.64.2; from 4.63.0, fixed in 4.63.2; from 4.62.0, fixed in 4.62.4; from 4.54.0, fixed in 4.58.1; fixed in 4.53.2.

    No fix released. The latest release, v4.43.4, is still affected.

  • CVE-2022-23600Medium 5.3

    Limited ability to spoof SAML authentication with missing audience verification

    Affected: fixed in 4.9.1.

    Fixed in v4.28.0 (released Feb 27, 2023, 388 days after disclosure, the advisory names 4.9.1, which was never published).

    The latest release, v4.43.4, is not affected.

  • CVE-2020-26276Critical 10.0

    SAML authentication vulnerability in Fleet

    Affected: fixed in 3.5.1.

    Fixed in v4.0.0 (released Jun 29, 2021, 194 days after disclosure, the advisory names 3.5.1, which was never published).

    The latest release, v4.43.4, is not affected.