CVE-2025-27509: Fleet SAML Authentication Vulnerability Leading to Unauthorized Access
Summary
CVE-2025-27509: Fleet has SAML authentication vulnerability due to improper SAML response validation. Affects github.com/fleetdm/fleet/v4 across 5 version ranges.
< 4.53.2
>= 4.54.0, < 4.58.1
>= 4.62.0, < 4.62.4
>= 4.63.0, < 4.63.2
>= 4.64.0, < 4.64.2
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fleet is an open-source platform designed for managing and monitoring devices across an organization. It provides functionalities such as device inventory, security monitoring, and compliance reporting. However, a critical vulnerability has been identified in its SAML authentication mechanism, which could allow attackers to impersonate legitimate users and gain unauthorized access to sensitive data and administrative functions.
Vulnerability Detail
The vulnerability arises from improper validation of SAML responses in Fleet. An attacker can craft a malicious SAML response that forges authentication assertions, potentially impersonating legitimate users. If Just-In-Time (JIT) provisioning is enabled, the attacker could create a new administrative user account. Additionally, if Mobile Device Management (MDM) enrollment is enabled, certain endpoints could be exploited to create new accounts linked to forged assertions. This vulnerability poses a significant risk, allowing unauthorized access to Fleet, including administrative privileges, visibility into device data, and the ability to modify configurations.
How To Fix
Latest published version: v4.43.4 as of 23 Oct 2026
go get github.com/fleetdm/fleet/v4@v4.43.4Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.53.24.53.2go get github.com/fleetdm/fleet/v4@v4.53.2 -
>= 4.54.0, < 4.58.14.58.1go get github.com/fleetdm/fleet/v4@v4.58.1 -
>= 4.62.0, < 4.62.44.62.4go get github.com/fleetdm/fleet/v4@v4.62.4 -
>= 4.63.0, < 4.63.24.63.2go get github.com/fleetdm/fleet/v4@v4.63.2 -
>= 4.64.0, < 4.64.24.64.2go get github.com/fleetdm/fleet/v4@v4.64.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If an immediate upgrade is not feasible, users should temporarily disable single-sign-on (SSO) and revert to password authentication. This can be done by modifying the configuration settings in the Fleet application to disable SSO.
Conclusion
CVE-2025-27509 is a critical vulnerability in Fleet's SAML authentication mechanism that could allow attackers to impersonate users and gain unauthorized access. Users are strongly advised to upgrade to the patched versions to mitigate this risk. In the interim, disabling SSO and using password authentication is recommended.
See every vulnerability recorded for github.com/fleetdm/fleet/v4 →
FAQ
The impact includes the potential for unauthorized access to Fleet, including administrative privileges and visibility into sensitive device data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If an upgrade is not possible, temporarily disable single-sign-on (SSO) and use password authentication as a workaround.
The vulnerability was discovered by @hakivvi, along with Jeffrey Hofmann and Colby Morgan from the Robinhood Red Team, through a responsible disclosure process.
The affected versions of Fleet are those prior to 4.64.2, specifically 4.64.0, 4.63.0, 4.62.0, and earlier versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/fleetdm/fleet/v4.
