Skip to content
OpenAdvisories
High WID-SEC-2026-2788 4 CVEs

Fleet: Mehrere Schwachstellen

Published Aug 11, 2026 · Updated Sep 27, 2026 · Revision 3 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in Fleet ausnutzen, um SQL-Injection durchzuführen, beliebigen Code auszuführen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.

Product

Fleet ist eine Open-Source-Plattform zur Geräteverwaltung, die es Unternehmen ermöglicht, ihre Infrastruktur zu überwachen und zu sichern.

Vulnerabilities 4

  • High 7.6
    CVE-2026-54245

    Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database

    Fleet is an open-source device management platform built on osquery. In versions prior to 4.86.2, the Okta conditional access integration in Fleet Premium is vulnerable to SQL injection through a host-supplied value that is used in a database query without pr…

    fleetdm fleet github.com/fleetdm/fleet/v4 github.com/fleetdm/fleet Go
  • Medium 6.5
    CVE-2026-48786

    Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint

    Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint (POST /api/latest/fleet/targets) returned unmasked team enroll secrets and full team configuration, including credential-bearing agent…

    fleetdm fleet github.com/fleetdm/fleet/v4 Go
  • Medium 5.3
    CVE-2026-101047

    Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs

    Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enterprise tier only) with the intended random, time-limited URL token. Because Apple's InstallEnterpriseApplication MDM command requires these …

    fleetdm fleet github.com/fleetdm/fleet/v4 Go
  • Low 3.1
    CVE-2026-101046

    Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints

    Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities). The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the ca…

    fleetdm fleet github.com/fleetdm/fleet/v4 Go

Revision history

  1. #3

    CVE-Nummern ergänzt

  2. #2

    Referenz(en) aufgenommen: EUVD-2026-66673, EUVD-2026-66657

  3. #1

    Initiale Fassung

References