Skip to content
OpenAdvisories
Medium WID-SEC-2026-1553 6 CVEs

Fleet: Mehrere Schwachstellen

Published May 14, 2026 · Updated May 14, 2026 · de-DE

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Fleet ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand herbeizuführen.

Product

Fleet ist eine Open-Source-Plattform zur Geräteverwaltung, die es Unternehmen ermöglicht, ihre Infrastruktur zu überwachen und zu sichern.

Vulnerabilities 6

  • High 8.7
    CVE-2026-26062

    Fleet server may terminate unexpectedly when handling certain gRPC requests

    Fleet is open source device management software. Prior to version 4.81.0, Fleet contained a denial-of-service (DoS) issue in the gRPC Launcher `PublishLogs` endpoint. In affected versions, certain unexpected input values were not handled gracefully, which cou…

    fleetdm fleet github.com/fleetdm/fleet/v4 Go
  • High 8.2
    CVE-2026-23998

    Fleet has a Windows MDM management endpoint authentication bypass

    Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet’s Windows MDM management endpoint could allow requests to be processed without proper client certificate validation. In certain circumstances, this could allow …

    fleetdm fleet github.com/fleetdm/fleet/v4 Go
  • High 8.2
    CVE-2026-24899

    Fleet Windows MDM Azure AD JWT Authentication Bypass

    Fleet is open source device management software. Prior to version 4.82.0, a vulnerability in Fleet's Windows MDM enrollment flow allows authentication tokens from any Azure AD tenant to be accepted. Because Fleet validates JWT signatures using Microsoft's mul…

    fleetdm fleet github.com/fleetdm/fleet/v4 Go
  • Medium 6.9
    CVE-2026-24000

    Fleet has a rate limiting bypass via untrusted client IP headers

    Fleet is open source device management software. Prior to version 4.80.1, Fleet trusted client-supplied IP address headers when determining the source IP for incoming requests. This allowed authenticated and unauthenticated clients to spoof their apparent IP …

    fleetdm fleet github.com/fleetdm/fleet/v4 Go
  • Medium 6.9
    CVE-2026-46356

    Fleet: IP spoofing allows bypassing API rate limiting

    Fleet is open source device management software. Prior to version 4.80.1, a vulnerability in Fleet's IP extraction logic allows unauthenticated attackers to bypass API rate limiting by spoofing client IP headers. This may allow brute-force login attempts or o…

    fleetdm fleet github.com/fleetdm/fleet/v4 Go
  • Medium 6.0
    CVE-2026-26191

    Fleet vulnerable to OS command injection in software packages

    Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet's software installer pipeline could allow a crafted software package to execute arbitrary commands as root (macOS/Linux) or SYSTEM (Windows) on managed endpoint…

    fleetdm fleet github.com/fleetdm/fleet/v4 Go

Revision history

  1. #1

    Initiale Fassung

References