Skip to content
OpenAdvisories

Vendor

fleetdm

41 known vulnerabilities.

Products

fleet 41
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-103264

    Fleet before 4.87.0 Authentication Bypass via Device Identifiers

    Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identi…

    fleetdm fleet
  • Critical 9.3
    CVE-2026-23518

    Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment

    Fleet is open source device management software. In versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3, a vulnerability in Fleet's Windows MDM enrollment flow could allow an attacker to submit forged authentication tokens that are not properly valid…

    fleetdm fleet github.com/fleetdm/fleet/v4 github.com/fleetdm/fleet Go
  • Critical 9.3
    CVE-2025-27509 Public exploit

    SAML authentication vulnerability due to improper SAML response validation

    fleetdm/fleet is an open source device management, built on osquery. In vulnerable versions of Fleet, an attacker could craft a specially-formed SAML response to forge authentication assertions, provision a new administrative user account if Just-In-Time (JIT…

    fleetdm fleet github.com/fleetdm/fleet/v4 Go
  • Critical 10.0
    CVE-2020-26276

    SAML authentication vulnerability in Fleet

    Fleet is an open source osquery manager. In Fleet before version 3.5.1, due to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from …

    fleetdm fleet github.com/fleetdm/fleet/v4 Go