Skip to content
OpenAdvisories

Vendor

fleetdm

41 known vulnerabilities.

Products

fleet 41
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Low 3.1
    CVE-2026-101046

    Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints

    Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities). The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the ca…

    fleetdm fleet github.com/fleetdm/fleet/v4 Go
  • Low 1.3
    CVE-2026-27465

    Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users

    Fleet is open source device management software. In versions prior to 4.80.1, a vulnerability in Fleet’s configuration API could expose Google Calendar service account credentials to authenticated users with low-privilege roles. This may allow unauthorized ac…

    fleetdm fleet github.com/fleetdm/fleet/v4 Go
  • Low 1.2
    CVE-2026-25963

    Fleet: Authorization Bypass in certificate template batch deletion for team administrators

    Fleet is open source device management software. In versions prior to 4.80.1, a broken authorization check in Fleet’s certificate template deletion API could allow a team administrator to delete certificate templates belonging to other teams within the same F…

    fleetdm fleet github.com/fleetdm/fleet/v4 Go
  • Low 0.6
    CVE-2026-23999

    Fleet: Device lock PIN can be predicted if lock time is known

    Fleet is open source device management software. In versions prior to 4.80.1, Fleet generated device lock and wipe PINs using a predictable algorithm based solely on the current Unix timestamp. Because no secret key or additional entropy was used, the resulti…

    fleetdm fleet github.com/fleetdm/fleet/v4 Go
  • Low 1.7
    CVE-2026-24004

    Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint

    Fleet is open source device management software. In versions prior to 4.80.1, a vulnerability in Fleet’s Android MDM Pub/Sub handling could allow unauthenticated requests to trigger device unenrollment events. This may result in unauthorized removal of indivi…

    fleetdm fleet github.com/fleetdm/fleet/v4 Go
  • Low 2.7
    CVE-2021-21296

    Denial-of-service in Fleet

    Fleet is an open source osquery manager. In Fleet before version 3.7.0 a malicious actor with a valid node key can send a badly formatted request that causes the Fleet server to exit, resulting in denial of service. This is possible only while a live query is…

    fleetdm fleet