# github.com/fleetdm/fleet/v4 (Go) vulnerabilities 32 known vulnerabilities (3 critical, 6 high, 18 medium, 5 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v4.43.4 (Jan 25, 2024): affected by 29 advisories - Newest unaffected release: Every release is affected by at least one advisory - Releases: 5 since v4.0.0 (Jun 29, 2021) - Registry: https://pkg.go.dev/github.com/fleetdm/fleet/v4 - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-101047: v4.0.0 to v4.43.4 (through the newest release) - CVE-2026-101046: v4.0.0 to v4.43.4 (through the newest release) - CVE-2026-54245: v4.0.0 to v4.43.4 (through the newest release) - CVE-2026-46371: v4.0.0 to v4.43.4 (through the newest release) - CVE-2026-46370: v4.0.0 to v4.43.4 (through the newest release) - CVE-2026-41262: v4.0.0 to v4.43.4 (through the newest release) - CVE-2026-48786: v4.0.0 to v4.43.4 (through the newest release) - CVE-2026-46356: v4.0.0 to v4.43.4 (through the newest release) - CVE-2026-26191: v4.0.0 to v4.43.4 (through the newest release) - CVE-2026-26062: v4.0.0 to v4.43.4 (through the newest release) - CVE-2026-24899: v4.0.0 to v4.43.4 (through the newest release) - CVE-2026-24000: v4.0.0 to v4.43.4 (through the newest release) - CVE-2026-23998: v4.0.0 to v4.43.4 (through the newest release) - CVE-2026-27806: v4.0.0 to v4.43.4 (through the newest release) - CVE-2026-34389: v4.0.0 to v4.43.4 (through the newest release) - CVE-2026-34388: v4.0.0 to v4.43.4 (through the newest release) - CVE-2026-34386: v4.0.0 to v4.43.4 (through the newest release) - CVE-2026-34385: v4.0.0 to v4.43.4 (through the newest release) - CVE-2026-29180: v4.0.0 to v4.43.4 (through the newest release) - CVE-2026-26061: v4.0.0 to v4.43.4 (through the newest release) - CVE-2026-26060: v4.0.0 to v4.43.4 (through the newest release) - CVE-2026-27465: v4.0.0 to v4.43.4 (through the newest release) - CVE-2026-25963: v4.0.0 to v4.43.4 (through the newest release) - CVE-2026-23999: v4.0.0 to v4.43.4 (through the newest release) - CVE-2026-24004: v4.0.0 to v4.43.4 (through the newest release) - CVE-2026-26186: v4.0.0 to v4.43.4 (through the newest release) - CVE-2026-23518: no published release is affected - CVE-2026-23517: v4.0.0 to v4.43.4 (through the newest release) - CVE-2026-22808: v4.0.0 to v4.43.4 (through the newest release) - CVE-2025-27509: v4.0.0 to v4.43.4 (through the newest release) - CVE-2022-23600: v4.0.0 to v4.1.0 (v4.28.0 is outside it) - CVE-2020-26276: no published release is affected ## Advisories (32) ### [CVE-2026-101047](https://cve.now/CVE-2026-101047): Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs - Severity: Medium 6.9 - Published: Sep 27, 2026 - Affected: fixed in 4.87.0. - No fix released. The advisory names 4.87.0 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected. ### [CVE-2026-101046](https://cve.now/CVE-2026-101046): Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints - Severity: Low 2.3 - Published: Sep 27, 2026 - Affected: fixed in 4.89.0. - No fix released. The advisory names 4.89.0 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected. ### [CVE-2026-54245](https://cve.now/CVE-2026-54245): Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database - Severity: High 7.6 - Published: Aug 26, 2026 - Affected: fixed in 4.86.2. - No fix released. The advisory names 4.86.2 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected. ### [CVE-2026-46371](https://cve.now/CVE-2026-46371): Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint - Severity: Medium 6.5 - Published: Aug 26, 2026 - Affected: fixed in 4.84.2. - No fix released. The advisory names 4.84.2 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected. ### [CVE-2026-46370](https://cve.now/CVE-2026-46370): Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint - Severity: Medium 6.5 - Published: Aug 26, 2026 - Affected: fixed in 4.84.2. - No fix released. The advisory names 4.84.2 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected. ### [CVE-2026-41262](https://cve.now/CVE-2026-41262): Fleet: Cross-Team Policy Data Exposure via Global Policy Read Endpoint - Severity: Medium 4.3 - Published: Aug 26, 2026 - Affected: fixed in 4.85.0. - No fix released. The advisory names 4.85.0 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected. ### [CVE-2026-48786](https://cve.now/CVE-2026-48786): Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint - Severity: Medium 6.5 - Published: Aug 26, 2026 - Affected: fixed in 4.87.0. - No fix released. The advisory names 4.87.0 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected. ### [CVE-2026-46356](https://cve.now/CVE-2026-46356): Fleet: IP spoofing allows bypassing API rate limiting - Severity: Medium 6.9 - Published: May 14, 2026 - Affected: fixed in 4.80.1. - No fix released. The advisory names 4.80.1 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected. ### [CVE-2026-26191](https://cve.now/CVE-2026-26191): Fleet vulnerable to OS command injection in software packages - Severity: Medium 6.0 - Published: May 14, 2026 - Affected: fixed in 4.81.1. - No fix released. The advisory names 4.81.1 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected. ### [CVE-2026-26062](https://cve.now/CVE-2026-26062): Fleet server may terminate unexpectedly when handling certain gRPC requests - Severity: High 8.7 - Published: May 14, 2026 - Affected: fixed in 4.81.0. - No fix released. The advisory names 4.81.0 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected. ### [CVE-2026-24899](https://cve.now/CVE-2026-24899): Fleet Windows MDM Azure AD JWT Authentication Bypass - Severity: High 8.2 - Published: May 14, 2026 - Affected: fixed in 4.82.0. - No fix released. The advisory names 4.82.0 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected. ### [CVE-2026-24000](https://cve.now/CVE-2026-24000): Fleet has a rate limiting bypass via untrusted client IP headers - Severity: Medium 6.9 - Published: May 14, 2026 - Affected: fixed in 4.80.1. - No fix released. The advisory names 4.80.1 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected. ### [CVE-2026-23998](https://cve.now/CVE-2026-23998): Fleet has a Windows MDM management endpoint authentication bypass - Severity: High 8.2 - Published: May 14, 2026 - Affected: fixed in 4.81.0. - No fix released. The advisory names 4.81.0 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected. ### [CVE-2026-27806](https://cve.now/CVE-2026-27806): Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit - Severity: High 7.8 - Published: Apr 8, 2026 - Affected: fixed in 4.81.1. - No fix released. The advisory names 4.81.1 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected. ### [CVE-2026-34389](https://cve.now/CVE-2026-34389): Fleet's user account creation via invite does not enforce invited email address - Severity: Medium 4.9 - Published: Mar 27, 2026 - Affected: fixed in 4.81.0. - No fix released. The advisory names 4.81.0 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected. ### [CVE-2026-34388](https://cve.now/CVE-2026-34388): Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint - Severity: Medium 6.6 - Published: Mar 27, 2026 - Affected: fixed in 4.81.0. - No fix released. The advisory names 4.81.0 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected. ### [CVE-2026-34386](https://cve.now/CVE-2026-34386): Fleet vulnerable to SQL injection in MDM bootstrap package by authenticated team or global admin - Severity: Medium 6.3 - Published: Mar 27, 2026 - Affected: fixed in 4.81.0. - No fix released. The advisory names 4.81.0 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected. ### [CVE-2026-34385](https://cve.now/CVE-2026-34385): Fleet's Apple MDM profile delivery has second-order SQL injection that can compromise the database - Severity: Medium 6.2 - Published: Mar 27, 2026 - Affected: fixed in 4.81.0. - No fix released. The advisory names 4.81.0 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected. ### [CVE-2026-29180](https://cve.now/CVE-2026-29180): Fleet's team maintainer can transfer hosts from any team via missing source team authorization - Severity: Medium 4.9 - Published: Mar 27, 2026 - Affected: fixed in 4.81.1. - No fix released. The advisory names 4.81.1 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected. ### [CVE-2026-26061](https://cve.now/CVE-2026-26061): Fleet's unbounded request body read allows remote Denial of Service - Severity: High 8.7 - Published: Mar 27, 2026 - Affected: fixed in 4.43.5-0.20260113202849-bbc1aef2987d; all versions. - No fix released. The latest release, v4.43.4, is still affected. ### [CVE-2026-26060](https://cve.now/CVE-2026-26060): Fleet: Password reset tokens remain valid after password change for 24 hours - Severity: Medium 6.0 - Published: Mar 27, 2026 - Affected: all versions; fixed in 4.43.5-0.20260113202849-bbc1aef2987d. - No fix released. The latest release, v4.43.4, is still affected. ### [CVE-2026-27465](https://cve.now/CVE-2026-27465): Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users - Severity: Low 1.3 - Published: Feb 26, 2026 - Affected: fixed in 4.80.1. - No fix released. The advisory names 4.80.1 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected. ### [CVE-2026-25963](https://cve.now/CVE-2026-25963): Fleet: Authorization Bypass in certificate template batch deletion for team administrators - Severity: Low 1.2 - Published: Feb 26, 2026 - Affected: fixed in 4.80.1. - No fix released. The advisory names 4.80.1 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected. ### [CVE-2026-23999](https://cve.now/CVE-2026-23999): Fleet: Device lock PIN can be predicted if lock time is known - Severity: Low 0.6 - Published: Feb 26, 2026 - Affected: fixed in 4.80.1. - No fix released. The advisory names 4.80.1 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected. ### [CVE-2026-24004](https://cve.now/CVE-2026-24004): Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint - Severity: Low 1.7 - Published: Feb 26, 2026 - Affected: fixed in 4.80.1. - No fix released. The advisory names 4.80.1 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected. ### [CVE-2026-26186](https://cve.now/CVE-2026-26186): Fleet has a SQL injection via backtick escape in ORDER BY parameter - Severity: Medium 5.1 - Published: Feb 26, 2026 - Affected: fixed in 4.80.1. - No fix released. The advisory names 4.80.1 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected. ### [CVE-2026-23518](https://cve.now/CVE-2026-23518): Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment - Severity: Critical 9.3 - Published: Jan 21, 2026 - Affected: from 4.75.0, fixed in 4.75.2; from 4.76.0, fixed in 4.76.2; from 4.77.0, fixed in 4.77.1; from 4.78.0, fixed in 4.78.3. - No fix released. The advisory names 4.75.2 and 4.76.2 and 4.77.1 and 4.78.3 as the fix, which the registry doesn't have yet. ### [CVE-2026-23517](https://cve.now/CVE-2026-23517): Fleet has an Access Control vulnerability in debug/pprof endpoints - Severity: Medium 6.3 - Published: Jan 21, 2026 - Affected: fixed in 4.78.3-0.20260112221730-5c030e32a3a9; from 4.75.0, fixed in 4.75.2; from 4.76.0, fixed in 4.76.2; from 4.77.0, fixed in 4.77.1; from 4.78.0, fixed in 4.78.3. - No fix released. The advisory names 4.78.3 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected. ### [CVE-2026-22808](https://cve.now/CVE-2026-22808): Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability - Severity: Medium 5.5 - Published: Jan 21, 2026 - Affected: from 4.75.0, fixed in 4.75.2; from 4.76.0, fixed in 4.76.2; from 4.77.0, fixed in 4.77.1; from 4.78.0, fixed in 4.78.2; fixed in 4.43.5-0.20260111020427-0e6c790803d1. - No fix released. The advisory names 4.43.5-0.20260111020427-0e6c790803d1 and 4.75.2 and 4.76.2 and 4.77.1 and 4.78.2 as the fix, which the registry doesn't have yet. The latest release, v4.43.4, is still affected. ### [CVE-2025-27509](https://cve.now/CVE-2025-27509): SAML authentication vulnerability due to improper SAML response validation - Severity: Critical 9.3 - Published: Mar 6, 2025 - Affected: all versions; from 4.64.0, fixed in 4.64.2; from 4.63.0, fixed in 4.63.2; from 4.62.0, fixed in 4.62.4; from 4.54.0, fixed in 4.58.1; fixed in 4.53.2. - No fix released. The latest release, v4.43.4, is still affected. ### [CVE-2022-23600](https://cve.now/CVE-2022-23600): Limited ability to spoof SAML authentication with missing audience verification - Severity: Medium 5.3 - Published: Feb 4, 2022 - Affected: fixed in 4.9.1. - Fixed in v4.28.0 (released Feb 27, 2023, 388 days after disclosure, the advisory names 4.9.1, which was never published). - The latest release, v4.43.4, is not affected. ### [CVE-2020-26276](https://cve.now/CVE-2020-26276): SAML authentication vulnerability in Fleet - Severity: Critical 10.0 - Published: Dec 17, 2020 - Affected: fixed in 3.5.1. - Fixed in v4.0.0 (released Jun 29, 2021, 194 days after disclosure, the advisory names 3.5.1, which was never published). - The latest release, v4.43.4, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/fleetdm/fleet/v4 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.