fleetdm

Records41All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical4CVSS 9.0–10.0

CVSS high10CVSS 7.0–8.9

Exploited now

fleetdm records in CISA KEV

No fleetdm vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Fleet 32 records MEDIUM

Records

32 records in Fleet · all components

TI-2026-65639 CVE-2026-103264 · GHSA-rmfg-c7hm-wv58

Fleet before 4.87.0 Authentication Bypass via Device Identifiers

MEDIUM 48

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00311 Published 2026-10-01 Fixed in 4.87.0 CWE-287

TI-2026-18942 CVE-2026-23518 · GHSA-63m5-974w-448v

Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment

MEDIUM 48

Fleet is open source device management software.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00254 Published 2026-01-21 Fixed in 4.78.3, 4.77.1 +4 CWE-347

TI-2020-16097 CVE-2020-26276 · GHSA-w3wf-cfx3-6gcx

SAML authentication vulnerability in Fleet

MEDIUM 47

Fleet is an open source osquery manager.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.02195 Published 2020-12-17 Fixed in 3.5.1 CWE-290

TI-2026-21066 CVE-2026-26062 · GHSA-x67p-9m2r-fxqv

Fleet server may terminate unexpectedly when handling certain gRPC requests

MEDIUM 44

Fleet is open source device management software.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00372 Published 2026-05-14 Fixed in 4.81.0 CWE-20

TI-2026-21065 CVE-2026-26061 · GHSA-99hj-44vg-hfcp

Fleet's unbounded request body read allows remote Denial of Service

MEDIUM 44

Fleet is open source device management software.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00451 Published 2026-03-27 Fixed in 4.81.0, 4.43.5-0.20260113202849-bbc1aef2987d CWE-770

TI-2026-20084 CVE-2026-24899 · GHSA-ffg9-j72f-j6xm

Fleet Windows MDM Azure AD JWT Authentication Bypass

MEDIUM 44

Fleet is open source device management software.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00381 Published 2026-05-14 Fixed in 4.82.0 CWE-290

TI-2026-19339 CVE-2026-24000 · GHSA-j8h8-75h3-jg53

Fleet has a rate limiting bypass via untrusted client IP headers

LOW 37

Fleet is open source device management software.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0043 Published 2026-05-14 Fixed in 4.80.1 CWE-290

TI-2022-08653 CVE-2022-24841

Improper Authorization in github.com/fleetdm/fleet

LOW 37

fleetdm/fleet is an open source device management, built on osquery.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00847 Published 2022-04-18 Fixed in 4.13 CWE-284

TI-2026-65080 CVE-2026-101047 · GHSA-jqp5-cmc9-xwxg

Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs

LOW 36

Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enterprise tier only) with the intended random, time-limited URL token.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00244 Published 2026-09-27 Fixed in 4.87.0 CWE-862

TI-2026-34073 CVE-2026-46356 · GHSA-mxmp-wr3w-rvqx

Fleet: IP spoofing allows bypassing API rate limiting

LOW 36

Fleet is open source device management software.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00276 Published 2026-05-14 Fixed in 4.80.1 CWE-290

TI-2026-26672 CVE-2026-34386 · GHSA-9p23-p2m4-2r4m

Fleet vulnerable to SQL injection in MDM bootstrap package by authenticated team or global admin

LOW 36

Fleet is open source device management software.

CVSS 4.0MEDIUM 6.3 Network Low privileges No interaction EPSS 0.0033 Published 2026-03-27 Fixed in 4.81.0 CWE-89

TI-2026-22159 CVE-2026-27806 · GHSA-rphv-h674-5hp2

Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit

LOW 35

Fleet is open source device management software.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00115 Published 2026-04-08 Fixed in 4.81.1 CWE-78

TI-2026-19337 CVE-2026-23998 · GHSA-2rc4-7jc6-qffh

Fleet has a Windows MDM management endpoint authentication bypass

LOW 35

Fleet is open source device management software.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00214 Published 2026-05-14 Fixed in 4.81.0 CWE-295

TI-2026-21177 CVE-2026-26186 · GHSA-49xw-vfc4-7p43

Fleet has a SQL injection via backtick escape in ORDER BY parameter

LOW 31

Fleet is open source device management software.

CVSS 4.0MEDIUM 5.1 Network Low privileges No interaction EPSS 0.0035 Published 2026-02-26 Fixed in 4.80.1 CWE-89

TI-2022-07653 CVE-2022-23600 · GHSA-ch68-7cf4-35vr

Limited ability to spoof SAML authentication with missing audience verification

LOW 31

fleet is an open source device management, built on osquery.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00893 Published 2022-02-04 Fixed in 4.9.1 CWE-287

TI-2026-26673 CVE-2026-34387

Fleet vulnerable to OS command injection via crafted software package metadata in uninstall scripts

LOW 30

Fleet is open source device management software.

CVSS 4.0MEDIUM 5.7 Network High privileges User interaction EPSS 0.01332 Published 2026-03-27 Fixed in 4.81.1 CWE-78

TI-2026-18941 CVE-2026-23517 · GHSA-4r5r-ccr6-q6f6

Fleet has an Access Control vulnerability in debug/pprof endpoints

LOW 30

Fleet is open source device management software.

CVSS 4.0MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00292 Published 2026-01-21 Fixed in 4.78.3, 4.77.1 +4 CWE-862

TI-2026-26674 CVE-2026-34388 · GHSA-w254-4hp5-7cvv

Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint

LOW 29

Fleet is open source device management software.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00273 Published 2026-03-27 Fixed in 4.81.0 CWE-703

TI-2026-26671 CVE-2026-34385 · GHSA-v895-833r-8c45

Fleet's Apple MDM profile delivery has second-order SQL injection that can compromise the database

LOW 29

Fleet is open source device management software.

CVSS 4.0MEDIUM 6.2 Network Low privileges No interaction EPSS 0.00205 Published 2026-03-27 Fixed in 4.81.0 CWE-89

TI-2026-26677 CVE-2026-34391

Fleet Vulnerable to Windows MDM cross-device command disclosure

LOW 28

Fleet is open source device management software.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00168 Published 2026-03-27 Fixed in 4.81.1 CWE-488

TI-2026-26675 CVE-2026-34389 · GHSA-4f9r-x588-pp2h

Fleet's user account creation via invite does not enforce invited email address

LOW 28

Fleet is open source device management software.

CVSS 4.0MEDIUM 4.9 Network Low privileges No interaction EPSS 0.00192 Published 2026-03-27 Fixed in 4.81.0 CWE-287

TI-2026-21182 CVE-2026-26191 · GHSA-9vcr-g537-3w5v

Fleet vulnerable to OS command injection in software packages

LOW 28

Fleet is open source device management software.

CVSS 4.0MEDIUM 6.0 Network No auth User interaction EPSS 0.00773 Published 2026-05-14 Fixed in 4.81.1 CWE-78

TI-2026-21064 CVE-2026-26060 · GHSA-3458-r943-hmx4

Fleet: Password reset tokens remain valid after password change for 24 hours

LOW 27

Fleet is open source device management software.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00348 Published 2026-03-27 Fixed in 4.81.0, 4.43.5-0.20260113202849-bbc1aef2987d CWE-613

TI-2026-18325 CVE-2026-22808 · GHSA-gfpw-jgvr-cw4j

Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability

LOW 24

fleetdm/fleet is open source device management software.

CVSS 4.0MEDIUM 5.5 Network Low privileges User interaction EPSS 0.00249 Published 2026-01-21 Fixed in 4.78.2, 4.77.1 +4 CWE-79

TI-2026-65640 CVE-2026-103265 · GHSA-hfhg-8x2p-pvmg

Fleet before 4.89.0 Information Disclosure via MDM Command Results

LOW 23

Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results endpoint.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00204 Published 2026-10-01 Fixed in 4.89.0 CWE-863

Open these records in search →