Vulnerabilities

Filters

2 selected

32 records

Sort

Vendor: fleetdm Component: Fleet Clear all filters

TI-2026-65640 CVE-2026-103265 · GHSA-hfhg-8x2p-pvmg

Fleet before 4.89.0 Information Disclosure via MDM Command Results

LOW 23

Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results endpoint.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00204 Published 2026-10-01 Fixed in 4.89.0 CWE-863

TI-2026-65639 CVE-2026-103264 · GHSA-rmfg-c7hm-wv58

Fleet before 4.87.0 Authentication Bypass via Device Identifiers

MEDIUM 48

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00311 Published 2026-10-01 Fixed in 4.87.0 CWE-287

TI-2026-65080 CVE-2026-101047 · GHSA-jqp5-cmc9-xwxg

Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs

LOW 36

Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enterprise tier only) with the intended random, time-limited URL token.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00244 Published 2026-09-27 Fixed in 4.87.0 CWE-862

TI-2026-65079 CVE-2026-101046 · GHSA-qhx2-24jf-9jj9

Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints

LOW 11

Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities).

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00171 Published 2026-09-27 Fixed in 4.89.0 CWE-89

TI-2026-34073 CVE-2026-46356 · GHSA-mxmp-wr3w-rvqx

Fleet: IP spoofing allows bypassing API rate limiting

LOW 36

Fleet is open source device management software.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00276 Published 2026-05-14 Fixed in 4.80.1 CWE-290

TI-2026-21182 CVE-2026-26191 · GHSA-9vcr-g537-3w5v

Fleet vulnerable to OS command injection in software packages

LOW 28

Fleet is open source device management software.

CVSS 4.0MEDIUM 6.0 Network No auth User interaction EPSS 0.00773 Published 2026-05-14 Fixed in 4.81.1 CWE-78

TI-2026-21066 CVE-2026-26062 · GHSA-x67p-9m2r-fxqv

Fleet server may terminate unexpectedly when handling certain gRPC requests

MEDIUM 44

Fleet is open source device management software.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00372 Published 2026-05-14 Fixed in 4.81.0 CWE-20

TI-2026-20084 CVE-2026-24899 · GHSA-ffg9-j72f-j6xm

Fleet Windows MDM Azure AD JWT Authentication Bypass

MEDIUM 44

Fleet is open source device management software.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00381 Published 2026-05-14 Fixed in 4.82.0 CWE-290

TI-2026-19339 CVE-2026-24000 · GHSA-j8h8-75h3-jg53

Fleet has a rate limiting bypass via untrusted client IP headers

LOW 37

Fleet is open source device management software.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0043 Published 2026-05-14 Fixed in 4.80.1 CWE-290

TI-2026-19337 CVE-2026-23998 · GHSA-2rc4-7jc6-qffh

Fleet has a Windows MDM management endpoint authentication bypass

LOW 35

Fleet is open source device management software.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00214 Published 2026-05-14 Fixed in 4.81.0 CWE-295

TI-2026-22159 CVE-2026-27806 · GHSA-rphv-h674-5hp2

Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit

LOW 35

Fleet is open source device management software.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00115 Published 2026-04-08 Fixed in 4.81.1 CWE-78

TI-2026-26677 CVE-2026-34391

Fleet Vulnerable to Windows MDM cross-device command disclosure

LOW 28

Fleet is open source device management software.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00168 Published 2026-03-27 Fixed in 4.81.1 CWE-488

TI-2026-26675 CVE-2026-34389 · GHSA-4f9r-x588-pp2h

Fleet's user account creation via invite does not enforce invited email address

LOW 28

Fleet is open source device management software.

CVSS 4.0MEDIUM 4.9 Network Low privileges No interaction EPSS 0.00192 Published 2026-03-27 Fixed in 4.81.0 CWE-287

TI-2026-26674 CVE-2026-34388 · GHSA-w254-4hp5-7cvv

Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint

LOW 29

Fleet is open source device management software.

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00273 Published 2026-03-27 Fixed in 4.81.0 CWE-703

TI-2026-26673 CVE-2026-34387

Fleet vulnerable to OS command injection via crafted software package metadata in uninstall scripts

LOW 30

Fleet is open source device management software.

CVSS 4.0MEDIUM 5.7 Network High privileges User interaction EPSS 0.01332 Published 2026-03-27 Fixed in 4.81.1 CWE-78

TI-2026-26672 CVE-2026-34386 · GHSA-9p23-p2m4-2r4m

Fleet vulnerable to SQL injection in MDM bootstrap package by authenticated team or global admin

LOW 36

Fleet is open source device management software.

CVSS 4.0MEDIUM 6.3 Network Low privileges No interaction EPSS 0.0033 Published 2026-03-27 Fixed in 4.81.0 CWE-89

TI-2026-26671 CVE-2026-34385 · GHSA-v895-833r-8c45

Fleet's Apple MDM profile delivery has second-order SQL injection that can compromise the database

LOW 29

Fleet is open source device management software.

CVSS 4.0MEDIUM 6.2 Network Low privileges No interaction EPSS 0.00205 Published 2026-03-27 Fixed in 4.81.0 CWE-89

TI-2026-23297 CVE-2026-29180 · GHSA-m2h6-4xpq-qw3m

Fleet's team maintainer can transfer hosts from any team via missing source team authorization

LOW 22

Fleet is open source device management software.

CVSS 4.0MEDIUM 4.9 Network Low privileges No interaction EPSS 0.00328 Published 2026-03-27 Fixed in 4.81.1 CWE-862

TI-2026-21065 CVE-2026-26061 · GHSA-99hj-44vg-hfcp

Fleet's unbounded request body read allows remote Denial of Service

MEDIUM 44

Fleet is open source device management software.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00451 Published 2026-03-27 Fixed in 4.81.0, 4.43.5-0.20260113202849-bbc1aef2987d CWE-770

TI-2026-21064 CVE-2026-26060 · GHSA-3458-r943-hmx4

Fleet: Password reset tokens remain valid after password change for 24 hours

LOW 27

Fleet is open source device management software.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00348 Published 2026-03-27 Fixed in 4.81.0, 4.43.5-0.20260113202849-bbc1aef2987d CWE-613

TI-2026-21872 CVE-2026-27465 · GHSA-2v6m-6xw3-6467

Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users

LOW 14

Fleet is open source device management software.

CVSS 4.0LOW 1.3 Network Low privileges No interaction EPSS 0.00275 Published 2026-02-26 Fixed in 4.80.1 CWE-201

TI-2026-20988 CVE-2026-25963 · GHSA-5jvp-m9h4-253h

Fleet: Authorization Bypass in certificate template batch deletion for team administrators

LOW 13

Fleet is open source device management software.

CVSS 4.0LOW 1.2 Network High privileges No interaction EPSS 0.00208 Published 2026-02-26 Fixed in 4.80.1 CWE-863

TI-2026-19338 CVE-2026-23999 · GHSA-ppwx-5jq7-px2w

Fleet: Device lock PIN can be predicted if lock time is known

LOW 4

Fleet is open source device management software.

CVSS 4.0LOW 0.6 Physical No auth No interaction EPSS 0.00141 Published 2026-02-26 Fixed in 4.80.1 CWE-330

TI-2026-19343 CVE-2026-24004 · GHSA-9pm7-6g36-6j78

Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint

LOW 9

Fleet is open source device management software.

CVSS 4.0LOW 1.7 Network No auth No interaction EPSS 0.00298 Published 2026-02-26 Fixed in 4.80.1 CWE-862

TI-2026-21177 CVE-2026-26186 · GHSA-49xw-vfc4-7p43

Fleet has a SQL injection via backtick escape in ORDER BY parameter

LOW 31

Fleet is open source device management software.

CVSS 4.0MEDIUM 5.1 Network Low privileges No interaction EPSS 0.0035 Published 2026-02-26 Fixed in 4.80.1 CWE-89