Skip to content
OpenAdvisories

Package · Go

github.com/fleetdm/fleet/v4

32 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-23518

    Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment

    Fleet is open source device management software. In versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3, a vulnerability in Fleet's Windows MDM enrollment flow could allow an attacker to submit forged authentication tokens that are not properly valid…

    fleetdm fleet github.com/fleetdm/fleet/v4 github.com/fleetdm/fleet Go
  • Critical 9.3
    CVE-2025-27509 Public exploit

    SAML authentication vulnerability due to improper SAML response validation

    fleetdm/fleet is an open source device management, built on osquery. In vulnerable versions of Fleet, an attacker could craft a specially-formed SAML response to forge authentication assertions, provision a new administrative user account if Just-In-Time (JIT…

    fleetdm fleet github.com/fleetdm/fleet/v4 Go
  • Critical 10.0
    CVE-2020-26276

    SAML authentication vulnerability in Fleet

    Fleet is an open source osquery manager. In Fleet before version 3.5.1, due to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from …

    fleetdm fleet github.com/fleetdm/fleet/v4 Go