HIGH7.5Go
GHSA-2rc4-7jc6-qffh· CVE-2026-23998, GO-2026-5002Fleet has a Windows MDM management endpoint authentication bypass
Modified: 6/8/2026
package
Go/github.com/fleetdm/fleet/v4
pkg:go/github.com/fleetdm/fleet/v4
HIGH7.1Go
GHSA-2v6m-6xw3-6467· CVE-2026-27465, GO-2026-4560Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users
Modified: 3/9/2026
MEDIUM6.0Go
GHSA-3458-r943-hmx4· CVE-2026-26060, GO-2026-4888Fleet: Password reset tokens remain valid after password change for 24 hours
Modified: 4/2/2026
MEDIUM5.1Go
GHSA-49xw-vfc4-7p43· CVE-2026-26186, GO-2026-4557Fleet has an SQL Injection vulnerability via backtick escape in ORDER BY parameter
Modified: 3/9/2026
MEDIUM4.9Go
GHSA-4f9r-x588-pp2h· CVE-2026-34389, GO-2026-4912Fleet's user account creation via invite does not enforce invited email address
Modified: 4/2/2026
HIGH7.1Go
GHSA-4r5r-ccr6-q6f6· CVE-2026-23517, GO-2026-4334Fleet has an Access Control vulnerability in debug/pprof endpoints
Modified: 2/28/2026
CRITICAL9.3Go
GHSA-52jx-g6m5-h735· CVE-2025-27509, GO-2025-3505Fleet has SAML authentication vulnerability due to improper SAML response validation
Modified: 2/3/2026
MEDIUM5.0Go
GHSA-5jvp-m9h4-253h· CVE-2026-25963, GO-2026-4561Fleet: Authorization Bypass in certificate template batch deletion for team administrators
Modified: 3/9/2026
MEDIUM6.5Go
GHSA-88p2-jj8w-j8qg· CVE-2026-48786, GO-2026-6220Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint
Modified: 8/18/2026
HIGH8.7Go
GHSA-99hj-44vg-hfcp· CVE-2026-26061, GO-2026-4889Fleet's unbounded request body read allows remote Denial of Service
Modified: 4/2/2026
MEDIUM6.3Go
GHSA-9p23-p2m4-2r4m· CVE-2026-34386, GO-2026-4913Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin
Modified: 4/2/2026
MEDIUM6.3Go
GHSA-9pm7-6g36-6j78· CVE-2026-24004, GO-2026-4563Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint
Modified: 3/9/2026
MEDIUM6.0Go
GHSA-9vcr-g537-3w5v· CVE-2026-26191, GO-2026-5301Fleet vulnerable to OS command injection in software packages
Modified: 6/25/2026
MEDIUM5.3Go
GHSA-ch68-7cf4-35vr· CVE-2022-23600Limited ability to spoof SAML authentication with missing audience verification in Fleet
Modified: 11/8/2023
HIGH7.5Go
GHSA-ffg9-j72f-j6xm· CVE-2026-24899, GO-2026-5358Fleet Windows MDM Azure AD JWT Authentication Bypass
Modified: 6/25/2026
MEDIUM5.5Go
GHSA-gfpw-jgvr-cw4j· CVE-2026-22808, GO-2026-4336Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability
Modified: 2/3/2026
MEDIUM4.3Go
GHSA-gm7f-v959-fr2g· CVE-2026-41262, GO-2026-5812Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint
Modified: 7/7/2026
MEDIUM5.3Go
GHSA-j8h8-75h3-jg53· CVE-2026-24000, GO-2026-5455Fleet has a rate limiting bypass via untrusted client IP headers
Modified: 6/25/2026
MEDIUM4.9Go
GHSA-m2h6-4xpq-qw3m· CVE-2026-29180, GO-2026-4892A Fleet team maintainer can transfer hosts from any team via missing source team authorization
Modified: 4/2/2026
MEDIUM6.9Go
GHSA-mxmp-wr3w-rvqx· CVE-2026-46356, GO-2026-5520Fleet: IP spoofing allows bypassing API rate limiting
Modified: 6/25/2026
MEDIUM4.1Go
GHSA-ppwx-5jq7-px2w· CVE-2026-23999, GO-2026-4564Fleet: Device lock PIN can be predicted if lock time is known
Modified: 3/9/2026
MEDIUM5.3Go
GHSA-q9c5-pp7m-fm2g· CVE-2026-101047, GO-2026-6268Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs
Modified: 9/28/2026
HIGH7.8Go
GHSA-rphv-h674-5hp2· CVE-2026-27806, GO-2026-5634Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit
Modified: 6/26/2026
LOW3.1Go
GHSA-rxhg-vcww-2mpw· CVE-2026-101046, GO-2026-6269Fleet: ORDER BY column injection on activity list endpoints
Modified: 9/28/2026
MEDIUM6.2Go
GHSA-v895-833r-8c45· CVE-2026-34385, GO-2026-4914Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the database
Modified: 4/2/2026
MEDIUM6.5Go
GHSA-vxm7-9x8v-8gm4· CVE-2026-46370, GO-2026-5682Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint
Modified: 6/26/2026
MEDIUM6.6Go
GHSA-w254-4hp5-7cvv· CVE-2026-34388, GO-2026-4915Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint
Modified: 4/2/2026
HIGHGo
GHSA-w3wf-cfx3-6gcx· CVE-2020-26276SAML authentication vulnerability due to stdlib XML parsing
Modified: 9/10/2026
MEDIUM6.5Go
GHSA-x4qr-qw6h-wvxq· CVE-2026-46371, GO-2026-5739Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint
Modified: 6/26/2026
HIGH8.7Go
GHSA-x67p-9m2r-fxqv· CVE-2026-26062, GO-2026-5744Fleet server may terminate unexpectedly when handling certain gRPC requests
Modified: 6/25/2026
CRITICAL9.3Go
GO-2025-3505· CVE-2025-27509, GHSA-52jx-g6m5-h735Fleet has SAML authentication vulnerability due to improper SAML response validation in github.com/fleetdm/fleet
Modified: 3/10/2025
HIGH8.1Go
GO-2026-4334· CVE-2026-23517, GHSA-4r5r-ccr6-q6f6Fleet has an Access Control vulnerability in debug/pprof endpoints in github.com/fleetdm/fleet
Modified: 2/3/2026
CRITICAL9.8Go
GO-2026-4335· CVE-2026-23518, GHSA-63m5-974w-448vFleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment in github.com/fleetdm/fleet
Modified: 2/4/2026
MEDIUM5.4Go
GO-2026-4336· CVE-2026-22808, GHSA-gfpw-jgvr-cw4jFleet Windows MDM endpoint has a Cross-site Scripting vulnerability in github.com/fleetdm/fleet
Modified: 2/3/2026
HIGH8.8Go
GO-2026-4557· CVE-2026-26186, GHSA-49xw-vfc4-7p43Fleet has an SQL Injection vulnerability via backtick escape in ORDER BY parameter in github.com/fleetdm/fleet
Modified: 3/9/2026
MEDIUM6.5Go
GO-2026-4560· CVE-2026-27465, GHSA-2v6m-6xw3-6467Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users in github.com/fleetdm/fleet
Modified: 3/9/2026
MEDIUM6.5Go
GO-2026-4561· CVE-2026-25963, GHSA-5jvp-m9h4-253hFleet: Authorization Bypass in certificate template batch deletion for team administrators in github.com/fleetdm/fleet
Modified: 3/9/2026
MEDIUM5.3Go
GO-2026-4563· CVE-2026-24004, GHSA-9pm7-6g36-6j78Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint in github.com/fleetdm/fleet
Modified: 3/9/2026
MEDIUM5.5Go
GO-2026-4564· CVE-2026-23999, GHSA-ppwx-5jq7-px2wFleet: Device lock PIN can be predicted if lock time is known in github.com/fleetdm/fleet
Modified: 3/9/2026
HIGH8.8Go
GO-2026-4888· CVE-2026-26060, GHSA-3458-r943-hmx4Fleet: Password reset tokens remain valid after password change for 24 hours in github.com/fleetdm/fleet
Modified: 4/2/2026
HIGH7.5Go
GO-2026-4889· CVE-2026-26061, GHSA-99hj-44vg-hfcpFleet's unbounded request body read allows remote Denial of Service in github.com/fleetdm/fleet
Modified: 4/2/2026
HIGH8.8Go
GO-2026-4892· CVE-2026-29180, GHSA-m2h6-4xpq-qw3mA Fleet team maintainer can transfer hosts from any team via missing source team authorization in github.com/fleetdm/fleet
Modified: 4/2/2026
MEDIUM6.5Go
GO-2026-4912· CVE-2026-34389, GHSA-4f9r-x588-pp2hFleet's user account creation via invite does not enforce invited email address in github.com/fleetdm/fleet
Modified: 4/2/2026
HIGH8.8Go
GO-2026-4913· CVE-2026-34386, GHSA-9p23-p2m4-2r4mFleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin in github.com/fleetdm/fleet
Modified: 4/2/2026
HIGH8.1Go
GO-2026-4914· CVE-2026-34385, GHSA-v895-833r-8c45Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the database in github.com/fleetdm/fleet
Modified: 4/2/2026
HIGH7.5Go
GO-2026-4915· CVE-2026-34388, GHSA-w254-4hp5-7cvvFleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint in github.com/fleetdm/fleet
Modified: 4/2/2026
HIGH7.5Go
GO-2026-5002· CVE-2026-23998, GHSA-2rc4-7jc6-qffhWindows MDM management endpoint authentication bypass in github.com/fleetdm/fleet/v4
Modified: 5/26/2026
CRITICAL9.8Go
GO-2026-5301· CVE-2026-26191, GHSA-9vcr-g537-3w5vFleet vulnerable to OS command injection in software packages in github.com/fleetdm/fleet
Modified: 6/25/2026
HIGH7.5Go
GO-2026-5358· CVE-2026-24899, GHSA-ffg9-j72f-j6xmFleet Windows MDM Azure AD JWT Authentication Bypass in github.com/fleetdm/fleet
Modified: 6/25/2026
MEDIUM5.3Go
GO-2026-5455· CVE-2026-24000, GHSA-j8h8-75h3-jg53Fleet has a rate limiting bypass via untrusted client IP headers in github.com/fleetdm/fleet
Modified: 6/25/2026
HIGH7.5Go
GO-2026-5520· CVE-2026-46356, GHSA-mxmp-wr3w-rvqxFleet: IP spoofing allows bypassing API rate limiting in github.com/fleetdm/fleet
Modified: 6/25/2026
HIGH7.8Go
GO-2026-5634· CVE-2026-27806, GHSA-rphv-h674-5hp2Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit in github.com/fleetdm/fleet
Modified: 6/25/2026
MEDIUM6.5Go
GO-2026-5682· CVE-2026-46370, GHSA-vxm7-9x8v-8gm4Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint in github.com/fleetdm/fleet
Modified: 6/25/2026
MEDIUM6.5Go
GO-2026-5739· CVE-2026-46371, GHSA-x4qr-qw6h-wvxqFleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint in github.com/fleetdm/fleet
Modified: 6/25/2026
MEDIUM6.5Go
GO-2026-5744· CVE-2026-26062, GHSA-x67p-9m2r-fxqvFleet server may terminate unexpectedly when handling certain gRPC requests in github.com/fleetdm/fleet
Modified: 6/25/2026
MEDIUM4.3Go
GO-2026-5812· CVE-2026-41262, GHSA-gm7f-v959-fr2gFleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint in github.com/fleetdm/fleet
Modified: 7/7/2026
MEDIUM6.5Go
GO-2026-6220· CVE-2026-48786, GHSA-88p2-jj8w-j8qgFleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint in github.com/fleetdm/fleet
Modified: 8/18/2026
HIGH7.6Go
GO-2026-6264· CVE-2026-54245, GHSA-7q96-f8xw-jv5jFleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database in github.com/fleetdm/fleet
Modified: 8/26/2026
MEDIUM5.3Go
GO-2026-6268· CVE-2026-101047, GHSA-q9c5-pp7m-fm2gFleet: Unauthenticated download of in-house iOS app binaries via predictable URLs in github.com/fleetdm/fleet
Modified: 9/28/2026
MEDIUM4.3Go
GO-2026-6269· CVE-2026-101046, GHSA-rxhg-vcww-2mpwFleet: ORDER BY column injection on activity list endpoints in github.com/fleetdm/fleet
Modified: 9/28/2026