CVE-2020-26276: SAML authentication vulnerability in github.com/fleetdm/fleet/v4
Summary
CVE-2020-26276: SAML authentication vulnerability due to stdlib XML parsing. Affects github.com/fleetdm/fleet/v4 versions < 3.5.1. Fixed in 3.5.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package github.com/fleetdm/fleet/v4 is written in Go and is used for Fleet, a popular open-source system for managing and monitoring fleets of macOS, Windows, and Linux machines. It provides features such as software deployment, remote execution, and configuration management. This package is responsible for handling SAML authentication in Fleet, allowing users to log in using Single Sign-On (SSO) with a SAML Identity Provider (IdP).
Vulnerability Detail
The vulnerability (CVE-2020-26276) is due to issues in Go's standard library XML parsing. An attacker can manipulate a valid SAML response to modify the trusted document, potentially allowing unverified logins from a SAML IdP. This can lead to unauthorized access to Fleet and compromise the security of the system. Users who have configured Fleet with SSO login are vulnerable to this issue.
How To Fix
Latest published version: v4.43.4 as of 23 Oct 2026
go get github.com/fleetdm/fleet/v4@v4.43.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.5.1
This is the first release that contains the fix.
go get github.com/fleetdm/fleet/v4@v3.5.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 3.5.1 is not possible, users can disable SSO authentication in Fleet as a temporary workaround. This can be done by modifying the configuration settings of Fleet to remove the SAML IdP integration. However, this workaround should only be considered temporary, and upgrading to the patched version is strongly recommended.
Conclusion
The vulnerability (CVE-2020-26276) in the github.com/fleetdm/fleet/v4 package allows an attacker to manipulate SAML responses and potentially gain unauthorized access to Fleet. Users who have configured Fleet with SSO login using a SAML IdP are advised to upgrade to version 3.5.1 or later to fix the vulnerability. If upgrading is not possible, disabling SSO authentication in Fleet can be used as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/fleetdm/fleet/v4 →
FAQ
The vulnerability allows an attacker to manipulate a SAML response and potentially gain unauthorized access to Fleet. This can lead to unauthorized actions, data breaches, and compromise of the system's security.
Users who have configured Fleet with SSO login using a SAML IdP are affected by this vulnerability.
You can use the Vulert Playground at Vulert Scanner to check if your Fleet installation is affected by this vulnerability. Simply provide the Gopkg.lock file of your Fleet installation and the Vulert Playground will analyze it for vulnerabilities.
Yes, the vulnerability has been patched in version 3.5.1 of the github.com/fleetdm/fleet/v4 package. Users should upgrade to this version or later to fix the vulnerability.
Yes, if upgrading to version 3.5.1 is not possible, you can disable SSO authentication in Fleet as a temporary workaround. This can be done by modifying the configuration settings of Fleet to remove the SAML IdP integration. However, upgrading to the patched version is strongly recommended.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/fleetdm/fleet/v4.
