CVE-2026-26062: Fleet Server Denial of Service Vulnerability in gRPC PublishLogs Endpoint
Summary
CVE-2026-26062: Fleet server may terminate unexpectedly when handling certain gRPC requests. Affects github.com/fleetdm/fleet/v4 versions < 4.81.0. Fixed in 4.81.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fleet is an open-source application designed for managing and monitoring fleets of devices. It provides functionalities such as log ingestion, device management, and real-time monitoring. The application is built using Go and utilizes gRPC for communication between components. This vulnerability arises from improper handling of input values in the PublishLogs endpoint, which can lead to server crashes.
Vulnerability Detail
The vulnerability in Fleet is a denial-of-service (DoS) issue located in the gRPC Launcher PublishLogs endpoint. It occurs when the server receives unexpected input values that are not handled correctly, resulting in the termination of the Fleet server process. An authenticated attacker with access to an enrolled Launcher node key can exploit this vulnerability by sending a single malicious gRPC request, leading to immediate service disruption. This vulnerability primarily affects availability and does not compromise sensitive data, authentication, or integrity.
How To Fix
Latest published version: v4.43.4 as of 23 Oct 2026
go get github.com/fleetdm/fleet/v4@v4.43.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.81.0
This is the first release that contains the fix.
go get github.com/fleetdm/fleet/v4@v4.81.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing the following workarounds:
- Restrict network access to the Fleet gRPC endpoint by limiting inbound access to known host IP ranges.
- Deploy Fleet behind infrastructure that filters or terminates gRPC traffic if Launcher log ingestion is not required.
- Monitor for repeated Fleet process crashes or unexpected restarts, which may indicate potential exploitation.
Conclusion
The CVE-2026-26062 vulnerability in Fleet's gRPC PublishLogs endpoint poses a significant risk of denial of service. It is crucial to upgrade to the patched version 4.81.0 or implement the suggested workarounds to mitigate the risk of exploitation. Regular monitoring and restricted access can further enhance security.
See every vulnerability recorded for github.com/fleetdm/fleet/v4 →
FAQ
The vulnerability leads to a denial of service, allowing an authenticated attacker to crash the Fleet server.
No, there is no exposure of sensitive data associated with this vulnerability.
Versions prior to 4.81.0 are affected by this vulnerability.
You can monitor for repeated crashes or unexpected restarts of the Fleet process.
Vulert monitors and alerts for open-source vulnerabilities in your software using just Gopkg.lock. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/fleetdm/fleet/v4.
