CVE-2026-26191: OS Command Injection Vulnerability in Fleet Package
Summary
CVE-2026-26191: Fleet vulnerable to OS command injection in software packages in github.com/fleetdm/fleet. Affects github.com/fleetdm/fleet/v4 versions < 4.81.1. Fixed in 4.81.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Fleet package, developed by fleetdm, is a powerful tool designed for managing and monitoring fleets of devices. It provides functionalities such as device tracking, reporting, and management through a centralized interface. However, it has been identified to have a critical vulnerability that exposes it to OS command injection attacks, which could potentially allow an attacker to execute arbitrary commands on the host system.
Vulnerability Detail
The vulnerability arises from improper handling of user inputs within the Fleet package, specifically in the way it processes commands. This flaw allows an attacker to inject malicious OS commands that the application may execute with elevated privileges. If exploited, this could lead to unauthorized access, data breaches, or complete system compromise. The vulnerability affects versions prior to 4.81.1, making it crucial for users to update to the latest version to mitigate risks.
How To Fix
Latest published version: v4.43.4 as of 23 Oct 2026
go get github.com/fleetdm/fleet/v4@v4.43.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.81.1
This is the first release that contains the fix.
go get github.com/fleetdm/fleet/v4@v4.81.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the Fleet application to trusted users only, minimizing the risk of exploitation until the package is updated. Additionally, implementing input validation and sanitization can help mitigate the risk of command injection.
Conclusion
The OS command injection vulnerability in the Fleet package (CVE-2026-26191) poses a significant risk to users. It is essential to update to version 4.81.1 or later to mitigate this risk. Users are encouraged to implement additional security measures and utilize tools like Vulert for ongoing monitoring.
See every vulnerability recorded for github.com/fleetdm/fleet/v4 →
FAQ
CVE-2026-26191 is a vulnerability in the Fleet package that allows for OS command injection, potentially enabling attackers to execute arbitrary commands on the host system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could lead to unauthorized access, data breaches, or complete system compromise, posing significant risks to users and their data.
You can update the Fleet package by running 'go get github.com/fleetdm/fleet/v4@v4.81.1' in your Go project directory.
Vulert is a monitoring tool that uses Gopkg.lock to alert users in real-time about open-source vulnerabilities in their software, helping maintain security.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/fleetdm/fleet/v4.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
