Description
fleetdm/fleet is an open source device management, built on osquery. In vulnerable versions of Fleet, an attacker could craft a specially-formed SAML response to forge authentication assertions, provision a new administrative user account if Just-In-Time (JIT) provisioning is enabled, or create new accounts tied to forged assertions if f MDM enrollment is enabled. This vulnerability is fixed in 4.64.2, 4.63.2, 4.62.4, and 4.58.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| fleetdm | fleet | >= 4.64.0, < 4.64.2, >= 4.63.0, < 4.63.2, >= 4.62.0, < 4.62.4, < 4.58.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250312T181707-1.1 | openSUSE-SU-2025:14889-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
Chillov3k/poc-cve-2025-27509 ★ 0 · Oct 21, 2026
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/fleetdm/fleet/v4 | >= 4.64.0, < 4.64.2 | 4.64.2 | GHSA-52jx-g6m5-h735 |
| Go | github.com/fleetdm/fleet/v4 | >= 4.63.0, < 4.63.2 | 4.63.2 | GHSA-52jx-g6m5-h735 |
| Go | github.com/fleetdm/fleet/v4 | >= 4.62.0, < 4.62.4 | 4.62.4 | GHSA-52jx-g6m5-h735 |
| Go | github.com/fleetdm/fleet/v4 | >= 4.54.0, < 4.58.1 | 4.58.1 | GHSA-52jx-g6m5-h735 |
| Go | github.com/fleetdm/fleet/v4 | < 4.53.2 | 4.53.2 | GHSA-52jx-g6m5-h735 |
| Go | github.com/fleetdm/fleet/v4 | all versions | — | GO-2025-3505 |
Advisories 2
- openSUSE-SU-2025:14889-1 govulncheck-vulndb-0.0.20250312T181707-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-0522 Fleet: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Mar 10, 2025