Read the docs
TI-2021-04396 Aliases CVE-2021-21296

Denial-of-service in Fleet

Priority LOW 18CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

Fleet is an open source osquery manager. In Fleet before version 3.7.0 a malicious actor with a valid node key can send a badly formatted request that causes the Fleet server to exit, resulting in denial of service. This is possible only while a live query is currently ongoing. We believe the impact of this vulnerability to be low given the requirement that the actor has a valid node key. There is no information disclosure, privilege escalation, or code execution. The issue is fixed in Fleet 3.7.0.

Why it matters now

EPSS 0.02025 81st percentileScored 2026-11-07
Fix Fixed fleet (fleetdm): 3.7.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
fleetdmfleetbefore 3.7.03.7.0Patch availableCNA
  • fleet Vendorfleetdm Affected before 3.7.0 Fixed in 3.7.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*before 3.7.0Vulnerablefleetdm
  • cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:* Versions before 3.7.0 Vulnerable ·fleetdm

Remediation

  • Fix · CNA fleet (fleetdm) Fixed in 3.7.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21296

References

Patch 1

Advisory 2

  • TI-2026-65639 Fleet before 4.87.0 Authentication Bypass via Device Identifiers CVSS 4.0CRITICAL 9.3
  • TI-2026-18942 Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment CVSS 4.0CRITICAL 9.3
  • TI-2020-16097 SAML authentication vulnerability in Fleet CVSS 3.1CRITICAL 10.0
  • TI-2026-21066 Fleet server may terminate unexpectedly when handling certain gRPC requests CVSS 4.0HIGH 8.7
  • TI-2026-21065 Fleet's unbounded request body read allows remote Denial of Service CVSS 4.0HIGH 8.7
  • TI-2026-20084 Fleet Windows MDM Azure AD JWT Authentication Bypass CVSS 4.0HIGH 8.2
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences