Skip to content
Fleetdm Fleet vulnerabilities
-
fleetdm fleet
Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression
CVE-2026-111924
8.7 High
-
fleetdm fleet
Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing
CVE-2026-111923
8.7 High
-
fleetdm fleet
Fleet before 4.89.0 Information Disclosure via MDM Command Results
CVE-2026-103265
5.3 Medium
-
fleetdm fleet
Fleet before 4.87.0 Authentication Bypass via Device Identifiers
CVE-2026-103264
9.3 Critical
-
fleetdm fleet
Fleet Homebrew Cask OS Command Injection via Metadata
CVE-2026-101045
8.9 High
-
fleetdm fleet, suse rancher fleet +1 more
Fleet: DNS exfiltration via Sprig getHostByName in fleet.yaml Helm template preprocessing
CVE-2026-75036
5.3 Medium
-
fleetdm fleet
Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints
CVE-2026-101046
Fix available
2.3 Low
-
fleetdm fleet
Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs
CVE-2026-101047
Fix available
6.9 Medium
-
fleetdm fleet
Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database
CVE-2026-54245
Fix available
7.6 High
-
fleetdm fleet
Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint
CVE-2026-48786
Fix available
6.5 Medium
-
fleetdm fleet
Fleet: Cross-Team Policy Data Exposure via Global Policy Read Endpoint
CVE-2026-41262
Fix available
4.3 Medium
-
fleetdm fleet
Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint
CVE-2026-46371
Fix available
6.5 Medium
-
fleetdm fleet
Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint
CVE-2026-46370
Fix available
6.5 Medium
-
fleetdm fleet
Fleet: IP spoofing allows bypassing API rate limiting
CVE-2026-46356
Fix available
6.9 Medium
-
fleetdm fleet
Fleet vulnerable to OS command injection in software packages
CVE-2026-26191
Fix available
6.0 Medium
-
fleetdm fleet
Fleet server may terminate unexpectedly when handling certain gRPC requests
CVE-2026-26062
Fix available
8.7 High
-
fleetdm fleet
Fleet Windows MDM Azure AD JWT Authentication Bypass
CVE-2026-24899
Fix available
8.2 High
-
fleetdm fleet
Fleet has a rate limiting bypass via untrusted client IP headers
CVE-2026-24000
Fix available
6.9 Medium
-
fleetdm fleet
Fleet has a Windows MDM management endpoint authentication bypass
CVE-2026-23998
Fix available
8.2 High
-
fleetdm fleet
Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit
CVE-2026-27806
Fix available
7.8 High
-
fleetdm fleet
Fleet Vulnerable to Windows MDM cross-device command disclosure
CVE-2026-34391
6.6 Medium
-
fleetdm fleet
Fleet's user account creation via invite does not enforce invited email address
CVE-2026-34389
Fix available
4.9 Medium
-
fleetdm fleet
Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint
CVE-2026-34388
Fix available
6.6 Medium
-
fleetdm fleet
Fleet vulnerable to OS command injection via crafted software package metadata in uninstall scripts
CVE-2026-34387
5.7 Medium
-
fleetdm fleet
Fleet vulnerable to SQL injection in MDM bootstrap package by authenticated team or global admin
CVE-2026-34386
Fix available
6.3 Medium
-
fleetdm fleet
Fleet's Apple MDM profile delivery has second-order SQL injection that can compromise the database
CVE-2026-34385
Fix available
6.2 Medium
-
fleetdm fleet
Fleet's team maintainer can transfer hosts from any team via missing source team authorization
CVE-2026-29180
Fix available
4.9 Medium
-
fleetdm fleet
Fleet's unbounded request body read allows remote Denial of Service
CVE-2026-26061
Fix available
8.7 High
-
fleetdm fleet
Fleet: Password reset tokens remain valid after password change for 24 hours
CVE-2026-26060
Fix available
6.0 Medium
-
fleetdm fleet
Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users
CVE-2026-27465
Fix available
1.3 Low
-
fleetdm fleet
Fleet: Authorization Bypass in certificate template batch deletion for team administrators
CVE-2026-25963
Fix available
1.2 Low
-
fleetdm fleet
Fleet: Device lock PIN can be predicted if lock time is known
CVE-2026-23999
Fix available
0.6 Low
-
fleetdm fleet
Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint
CVE-2026-24004
Fix available
1.7 Low
-
fleetdm fleet
Fleet has a SQL injection via backtick escape in ORDER BY parameter
CVE-2026-26186
Fix available
5.1 Medium
-
fleetdm fleet
Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment
CVE-2026-23518
Fix available
9.3 Critical
-
fleetdm fleet
Fleet has an Access Control vulnerability in debug/pprof endpoints
CVE-2026-23517
Fix available
6.3 Medium
-
fleetdm fleet
Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability
CVE-2026-22808
Fix available
5.5 Medium
-
fleetdm fleet, mir robot +1 more
Open redirect in web server of MiR robots and MiR fleet
CVE-2025-13819
6.1 Medium
-
fleetdm fleet
Fleet doesn’t validate a server’s certificate when connecting through SSH
CVE-2025-23390
Fix available
6.3 Medium
-
fleetdm fleet
SAML authentication vulnerability due to improper SAML response validation
CVE-2025-27509
Public exploitFix available
9.3 Critical
-
fleetdm fleet
Improper Authorization in github.com/fleetdm/fleet
CVE-2022-24841
6.5 Medium
-
fleetdm fleet
Limited ability to spoof SAML authentication with missing audience verification
CVE-2022-23600
Fix available
5.3 Medium
-
fleetdm fleet
Denial-of-service in Fleet
CVE-2021-21296
2.7 Low
-
fleetdm fleet
SAML authentication vulnerability in Fleet
CVE-2020-26276
Fix available
10.0 Critical
-
fleet
Fleet before 2.1.2 allows exposure of SMTP credentials.
CVE-2019-1020009
7.5 High