CVE-2022-23600: Limited ability to spoof SAML authentication in Fleet
Summary
CVE-2022-23600: Limited ability to spoof SAML authentication with missing audience verification in Fleet. Affects github.com/fleetdm/fleet/v4 versions < 4.9.1. Fixed in 4.9.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Fleet is an open-source software that provides centralized device management and monitoring. It allows organizations to manage their fleet of devices efficiently. The software is written in Go and is widely used in various industries. However, a vulnerability has been discovered in Fleet that affects deployments using SAML SSO (Single Sign-On).
Vulnerability Detail
The vulnerability in Fleet allows for limited ability to spoof SAML authentication. There are two specific cases where this vulnerability can be exploited:
- A malicious or compromised Service Provider (SP) can reuse a SAML response to log into Fleet as a user, but only if the user has an account with the same email in Fleet and signs into the malicious SP via SAML SSO from the same Identity Provider (IdP) configured with Fleet.
- A user with an account in Fleet can reuse a SAML response intended for another SP to log into Fleet. This is only a concern if the user is blocked from Fleet in the IdP but continues to have an account in Fleet. If the user is blocked from the IdP entirely, this cannot be exploited.
These scenarios pose a moderate risk as they can lead to unauthorized access to Fleet accounts and potential misuse of user privileges.
How To Fix
Latest published version: v4.43.4 as of 23 Oct 2026
go get github.com/fleetdm/fleet/v4@v4.43.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.9.1
This is the first release that contains the fix.
go get github.com/fleetdm/fleet/v4@v4.9.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
While updating to the latest version is the recommended solution, there are some workarounds that can be implemented to reduce the risk:
- Reduce the length of sessions on the Identity Provider (IdP) to minimize the window for malicious re-use.
- Limit the number of SAML Service Providers/Applications used by user accounts with access to Fleet.
- When removing access to Fleet in the IdP, make sure to also delete the corresponding Fleet user from Fleet itself.
Conclusion
The vulnerability in Fleet that allows for limited ability to spoof SAML authentication can be mitigated by updating to version 4.9.1 or later. It is important to apply the necessary patches to ensure the security of Fleet deployments. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/fleetdm/fleet/v4 →
FAQ
Fleet is an open-source software that provides centralized device management and monitoring. It is widely used in various industries to manage fleets of devices efficiently.
SAML SSO (Security Assertion Markup Language Single Sign-On) is a standard for logging into multiple applications using a single set of credentials. It allows users to authenticate once with an Identity Provider (IdP) and then access multiple Service Providers (SPs) without the need for separate logins.
The vulnerability in Fleet allows for limited ability to spoof SAML authentication. It can be exploited by a malicious or compromised Service Provider (SP) reusing a SAML response to log into Fleet as a user, or by a user reusing a SAML response intended for another SP to log into Fleet.
The vulnerability poses a moderate risk as it can lead to unauthorized access to Fleet accounts and potential misuse of user privileges.
To mitigate the risk, it is recommended to update Fleet to version 4.9.1 or later. Additionally, implementing the provided workarounds can help reduce the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/fleetdm/fleet/v4.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
