{"id":"CVE-2020-26276","aliases":["EUVD-2022-1220","GHSA-w3wf-cfx3-6gcx"],"status":"published","title":"SAML authentication vulnerability in Fleet","description":"Fleet is an open source osquery manager. In Fleet before version 3.5.1, due to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from a SAML IdP. Users that configure Fleet with SSO login may be vulnerable to this issue. This issue is patched in 3.5.1. The fix was made using https://github.com/mattermost/xml-roundtrip-validator If upgrade to 3.5.1 is not possible, users should disable SSO authentication in Fleet.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.02195,"percentile":0.82731,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-290"],"published":"2020-12-17T19:40:14Z","modified":"2026-10-20T10:54:25Z","fixes":[{"ecosystem":"Go","package":"github.com/fleetdm/fleet/v4","fixed_in":["3.5.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/fleetdm/fleet/v4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/fleetdm/fleet/v4","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.5.1"}]}]}],"products":[{"vendor":"fleetdm","product":"fleet"}],"references":[{"url":"https://github.com/fleetdm/fleet/security/advisories/GHSA-w3wf-cfx3-6gcx","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/fleetdm/fleet/commit/57812a532e5f749c8e18c6f6a652eca65c083607","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/fleetdm/fleet/blob/master/CHANGELOG.md#fleet-351-dec-14-2020","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://github.com/mattermost/xml-roundtrip-validator","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities","tags":["x_refsource_MISC","x_transferred","Not Applicable","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-26276","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w3wf-cfx3-6gcx"}],"sources":{"cve":[{"id":"CVE-2020-26276","title":"SAML authentication vulnerability in Fleet","description":"Fleet is an open source osquery manager. In Fleet before version 3.5.1, due to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from a SAML IdP. Users that configure Fleet with SSO login may be vulnerable to this issue. This issue is patched in 3.5.1. The fix was made using https://github.com/mattermost/xml-roundtrip-validator If upgrade to 3.5.1 is not possible, users should disable SSO authentication in Fleet.","status":"published","published":"2020-12-17T19:40:14Z","modified":"2024-08-04T15:56:04.5Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:35:46.129376Z"}],"euvd":[{"id":"EUVD-2022-1220","description":"Fleet is an open source osquery manager. In Fleet before version 3.5.1, due to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from a SAML IdP. Users that configure Fleet with SSO login may be vulnerable to this issue. This issue is patched in 3.5.1. The fix was made using https://github.com/mattermost/xml-roundtrip-validator If upgrade to 3.5.1 is not possible, users should disable SSO authentication in Fleet.","status":"published","published":"2020-12-17T19:40:14Z","modified":"2024-08-04T15:56:04Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T03:07:14.653267Z"}],"ghsa":[{"id":"GHSA-w3wf-cfx3-6gcx","title":"SAML authentication vulnerability due to stdlib XML parsing","description":"### Impact\nDue to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from a SAML IdP.\n\nUsers that configure Fleet with SSO login may be vulnerable to this issue.\n\n### Patches\nThis issue is patched in 3.5.1 using https://github.com/mattermost/xml-roundtrip-validator.\n\n### Workarounds\nIf upgrade to 3.5.1 is not possible, users should disable SSO authentication in Fleet.\n\n### References\nSee https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/ for more information about the underlying vulnerabilities.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [security@fleetdm.com](mailto:security@fleetdm.com)\n* Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)","status":"published","published":"2022-02-11T23:59:14Z","modified":"2023-02-01T05:05:44Z","cwes":["CWE-290"],"updated_at":"2026-11-02T14:36:35.781528Z"}],"nvd":[{"id":"CVE-2020-26276","description":"Fleet is an open source osquery manager. In Fleet before version 3.5.1, due to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from a SAML IdP. Users that configure Fleet with SSO login may be vulnerable to this issue. This issue is patched in 3.5.1. The fix was made using https://github.com/mattermost/xml-roundtrip-validator If upgrade to 3.5.1 is not possible, users should disable SSO authentication in Fleet.","status":"published","published":"2020-12-17T20:15:13.76Z","modified":"2026-06-17T03:07:58.797Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:06:27.73474Z"}],"osv":[{"id":"CVE-2020-26276","description":"Fleet is an open source osquery manager. In Fleet before version 3.5.1, due to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from a SAML IdP. Users that configure Fleet with SSO login may be vulnerable to this issue. This issue is patched in 3.5.1. The fix was made using https://github.com/mattermost/xml-roundtrip-validator If upgrade to 3.5.1 is not possible, users should disable SSO authentication in Fleet.","status":"published","published":"2020-12-17T20:15:13.76Z","modified":"2026-10-20T10:54:25.433669321Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:16.248747Z"},{"id":"GHSA-w3wf-cfx3-6gcx","title":"SAML authentication vulnerability due to stdlib XML parsing","description":"### Impact\nDue to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from a SAML IdP.\n\nUsers that configure Fleet with SSO login may be vulnerable to this issue.\n\n### Patches\nThis issue is patched in 3.5.1 using https://github.com/mattermost/xml-roundtrip-validator.\n\n### Workarounds\nIf upgrade to 3.5.1 is not possible, users should disable SSO authentication in Fleet.\n\n### References\nSee https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/ for more information about the underlying vulnerabilities.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [security@fleetdm.com](mailto:security@fleetdm.com)\n* Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)","status":"published","published":"2022-02-11T23:59:14Z","modified":"2026-09-10T03:49:12.818096744Z","cwes":["CWE-290"],"updated_at":"2026-11-02T15:46:58.04805Z"}]}}