CVE-2026-41262: Fleet DM Global Policy Data Exposure Vulnerability
Summary
CVE-2026-41262: Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint. Affects github.com/fleetdm/fleet/v4 versions < 4.85.0. Fixed in 4.85.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fleet DM is an open-source platform designed for managing and monitoring fleets of devices. It provides features such as policy management, compliance checks, and security monitoring across various teams within an organization. This vulnerability arises from improper authorization checks in the global policy read endpoint, potentially exposing sensitive policy data across team boundaries.
Vulnerability Detail
The vulnerability is located in the global policy read endpoint (GET /api/latest/fleet/policies/{policy_id}). It fails to properly verify that the fetched policy belongs to the global scope, allowing users with observer-level access on any team to read policies from other teams. This breach of the team isolation model can lead to unauthorized access to sensitive information, including SQL queries and compliance data, which could be exploited by malicious actors.
How To Fix
Latest published version: v4.43.4 as of 23 Oct 2026
go get github.com/fleetdm/fleet/v4@v4.43.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.85.0
This is the first release that contains the fix.
go get github.com/fleetdm/fleet/v4@v4.85.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the global policy read endpoint by implementing additional authorization checks at the application level until the package is updated.
Conclusion
CVE-2026-41262 represents a significant vulnerability in Fleet DM that can compromise the security of policy data across teams. Organizations using Fleet DM should prioritize updating to the patched version to safeguard against potential data exposure.
See every vulnerability recorded for github.com/fleetdm/fleet/v4 →
FAQ
CVE-2026-41262 is a vulnerability in Fleet DM that allows unauthorized access to policy data across different teams due to improper authorization checks.
This vulnerability can lead to exposure of sensitive policy data, including SQL queries and compliance metrics, which could be exploited to gain insights into your organization's security posture.
If you are using an affected version, it is recommended to update to version 4.85.0 or later to mitigate the vulnerability.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/fleetdm/fleet/v4.
