Skip to content
OpenAdvisories

Package · Go

github.com/fleetdm/fleet/v4

32 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.6
    CVE-2026-54245

    Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database

    Fleet is an open-source device management platform built on osquery. In versions prior to 4.86.2, the Okta conditional access integration in Fleet Premium is vulnerable to SQL injection through a host-supplied value that is used in a database query without pr…

    fleetdm fleet github.com/fleetdm/fleet/v4 github.com/fleetdm/fleet Go
  • High 8.7
    CVE-2026-26062

    Fleet server may terminate unexpectedly when handling certain gRPC requests

    Fleet is open source device management software. Prior to version 4.81.0, Fleet contained a denial-of-service (DoS) issue in the gRPC Launcher `PublishLogs` endpoint. In affected versions, certain unexpected input values were not handled gracefully, which cou…

    fleetdm fleet github.com/fleetdm/fleet/v4 Go
  • High 8.2
    CVE-2026-24899

    Fleet Windows MDM Azure AD JWT Authentication Bypass

    Fleet is open source device management software. Prior to version 4.82.0, a vulnerability in Fleet's Windows MDM enrollment flow allows authentication tokens from any Azure AD tenant to be accepted. Because Fleet validates JWT signatures using Microsoft's mul…

    fleetdm fleet github.com/fleetdm/fleet/v4 Go
  • High 8.2
    CVE-2026-23998

    Fleet has a Windows MDM management endpoint authentication bypass

    Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet’s Windows MDM management endpoint could allow requests to be processed without proper client certificate validation. In certain circumstances, this could allow …

    fleetdm fleet github.com/fleetdm/fleet/v4 Go
  • High 7.8
    CVE-2026-27806

    Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit

    Fleet is open source device management software. Prior to 4.81.1, the Orbit agent's FileVault disk encryption key rotation flow on collects a local user's password via a GUI dialog and interpolates it directly into a Tcl/expect script executed via exec.Comman…

    fleetdm fleet github.com/fleetdm/fleet/v4 Go
  • High 8.7
    CVE-2026-26061

    Fleet's unbounded request body read allows remote Denial of Service

    Fleet is open source device management software. Prior to 4.81.0, Fleet contained multiple unauthenticated HTTP endpoints that read request bodies without enforcing a size limit. An unauthenticated attacker could exploit this behavior by sending large or repe…

    fleetdm fleet github.com/fleetdm/fleet/v4 Go