Read the docs
TI-2026-18325 Aliases CVE-2026-22808GHSA-gfpw-jgvr-cw4j

Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability

Priority LOW 24CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

fleetdm/fleet is open source device management software. Prior to versions 4.78.2, 4.77.1, 4.76.2, 4.75.2, and 4.53.3, if Windows MDM is enabled, an unauthenticated attacker can exploit this XSS vulnerability to steal a Fleet administrator's authentication token (FLEET::auth_token) from localStorage. This could allow unauthorized access to Fleet, including administrative access, visibility into device data, and modification of configuration. Versions 4.78.2, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 fix the issue. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00249 16th percentileScored 2026-11-07
Fix Fixed fleet (fleetdm): 4.78.2, 4.77.1, 4.76.2 +1github.com/fleetdm/fleet (Go): 4.78.2, 4.77.1, 4.76.2 +1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
fleetdmfleet4.78.0 to before 4.78.2; 4.77.0 to before 4.77.1; 4.76.0 to before 4.76.2; before 4.53.34.78.2, 4.77.1, 4.76.2, 4.53.3Patch availableCNA
—github.com/fleetdm/fleet (Go)4.78.0 to before 4.78.24.78.2Patch availableGHSA-gfpw-jgvr-cw4j
—github.com/fleetdm/fleet (Go)4.77.0 to before 4.77.14.77.1Patch availableGHSA-gfpw-jgvr-cw4j
—github.com/fleetdm/fleet (Go)4.76.0 to before 4.76.24.76.2Patch availableGHSA-gfpw-jgvr-cw4j
—github.com/fleetdm/fleet (Go)4.75.0 to before 4.75.24.75.2Patch availableGHSA-gfpw-jgvr-cw4j
—github.com/fleetdm/fleet/v4 (Go)before 4.43.5-0.20260111020427-0e6c790803d14.43.5-0.20260111020427-0e6c790803d1Patch availableGHSA-gfpw-jgvr-cw4j
  • fleet Vendorfleetdm Affected 4.78.0 to before 4.78.2; 4.77.0 to before 4.77.1; 4.76.0 to before 4.76.2; before 4.53.3 Fixed in 4.78.2, 4.77.1, 4.76.2, 4.53.3 Patch available CNA
  • github.com/fleetdm/fleet (Go) Vendor— Affected 4.78.0 to before 4.78.2 Fixed in 4.78.2 Patch available GHSA-gfpw-jgvr-cw4j
  • github.com/fleetdm/fleet (Go) Vendor— Affected 4.77.0 to before 4.77.1 Fixed in 4.77.1 Patch available GHSA-gfpw-jgvr-cw4j
  • github.com/fleetdm/fleet (Go) Vendor— Affected 4.76.0 to before 4.76.2 Fixed in 4.76.2 Patch available GHSA-gfpw-jgvr-cw4j
  • github.com/fleetdm/fleet (Go) Vendor— Affected 4.75.0 to before 4.75.2 Fixed in 4.75.2 Patch available GHSA-gfpw-jgvr-cw4j
  • github.com/fleetdm/fleet/v4 (Go) Vendor— Affected before 4.43.5-0.20260111020427-0e6c790803d1 Fixed in 4.43.5-0.20260111020427-0e6c790803d1 Patch available GHSA-gfpw-jgvr-cw4j

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*before 4.53.3; 4.75.0 to before 4.75.2; 4.76.0 to before 4.76.2; 4.78.0 to before 4.78.2Vulnerablefleetdm
cpe:2.3:a:fleetdm:fleet:4.77.0:*:*:*:*:*:*:*4.77.0Vulnerablefleetdm
  • cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:* Versions before 4.53.3; 4.75.0 to before 4.75.2; 4.76.0 to before 4.76.2; 4.78.0 to before 4.78.2 Vulnerable ·fleetdm
  • cpe:2.3:a:fleetdm:fleet:4.77.0:*:*:*:*:*:*:* Versions 4.77.0 Vulnerable ·fleetdm

Remediation

  • Fix · CNA fleet (fleetdm) Fixed in 4.78.2, 4.77.1, 4.76.2, 4.53.3
  • Fix · GHSA-gfpw-jgvr-cw4j github.com/fleetdm/fleet (Go) Fixed in 4.78.2 Advisory →
  • Fix · GHSA-gfpw-jgvr-cw4j github.com/fleetdm/fleet (Go) Fixed in 4.77.1 Advisory →
  • Fix · GHSA-gfpw-jgvr-cw4j github.com/fleetdm/fleet (Go) Fixed in 4.76.2 Advisory →
  • Fix · GHSA-gfpw-jgvr-cw4j github.com/fleetdm/fleet (Go) Fixed in 4.75.2 Advisory →
  • Fix · GHSA-gfpw-jgvr-cw4j github.com/fleetdm/fleet/v4 (Go) Fixed in 4.43.5-0.20260111020427-0e6c790803d1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-22808
  2. 2026-10-03 Alias added: GHSA-gfpw-jgvr-cw4j

References

Advisory 2

Other 2

  • TI-2026-65639 Fleet before 4.87.0 Authentication Bypass via Device Identifiers CVSS 4.0CRITICAL 9.3
  • TI-2026-18942 Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment CVSS 4.0CRITICAL 9.3
  • TI-2020-16097 SAML authentication vulnerability in Fleet CVSS 3.1CRITICAL 10.0
  • TI-2026-21066 Fleet server may terminate unexpectedly when handling certain gRPC requests CVSS 4.0HIGH 8.7
  • TI-2026-21065 Fleet's unbounded request body read allows remote Denial of Service CVSS 4.0HIGH 8.7
  • TI-2026-20084 Fleet Windows MDM Azure AD JWT Authentication Bypass CVSS 4.0HIGH 8.2
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences