Fleetdm vulnerabilities
41 CVEs and advisories name Fleetdm as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-111924Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression
- CVE-2026-111923Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing
- CVE-2026-103265Fleet before 4.89.0 Information Disclosure via MDM Command Results
- CVE-2026-103264Fleet before 4.87.0 Authentication Bypass via Device Identifiers
- CVE-2026-101047Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs
- CVE-2026-101046Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints
- CVE-2026-101045Fleet Homebrew Cask OS Command Injection via Metadata
- CVE-2026-54245Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database
- CVE-2026-46371Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint
- CVE-2026-46370Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint
- CVE-2026-41262Fleet: Cross-Team Policy Data Exposure via Global Policy Read Endpoint
- CVE-2026-48786Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint
- CVE-2026-46356Fleet: IP spoofing allows bypassing API rate limiting
- CVE-2026-26191Fleet vulnerable to OS command injection in software packages
- CVE-2026-26062Fleet server may terminate unexpectedly when handling certain gRPC requests
- CVE-2026-24899Fleet Windows MDM Azure AD JWT Authentication Bypass
- CVE-2026-24000Fleet has a rate limiting bypass via untrusted client IP headers
- CVE-2026-23998Fleet has a Windows MDM management endpoint authentication bypass
- CVE-2026-27806Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit
- CVE-2026-34391Fleet Vulnerable to Windows MDM cross-device command disclosure
- CVE-2026-34389Fleet's user account creation via invite does not enforce invited email address
- CVE-2026-34388Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint
- CVE-2026-34387Fleet vulnerable to OS command injection via crafted software package metadata in uninstall scripts
- CVE-2026-34386Fleet vulnerable to SQL injection in MDM bootstrap package by authenticated team or global admin
- CVE-2026-34385Fleet's Apple MDM profile delivery has second-order SQL injection that can compromise the database
- CVE-2026-29180Fleet's team maintainer can transfer hosts from any team via missing source team authorization
- CVE-2026-26061Fleet's unbounded request body read allows remote Denial of Service
- CVE-2026-26060Fleet: Password reset tokens remain valid after password change for 24 hours
- CVE-2026-27465Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users
- CVE-2026-25963Fleet: Authorization Bypass in certificate template batch deletion for team administrators