VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/fleetdm/fleet/v4: vulnerability history, versions and safety

github.com/fleetdm/fleet/v4 is a package in the Go ecosystem. Vulert records 57 vulnerabilities for it across 95 releases, from Feb 2022 to Aug 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
57 vulnerabilities recorded C1 H7 M18 L1 U30
i
3 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
53 in the last 12 months

Most recent disclosure 25 Aug 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/fleetdm/fleet/v4 vulnerabilities

Vulert verdict on github.com/fleetdm/fleet/v4 v4.43.4 i

Updated on 23 Oct 2026

Careful: v4.43.4 has 53 known vulnerabilities, and 3 have no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 57/100
  • Security Unfixed issues
  • Maintenance Maintaining
  • Popularity Key ecosystem project
  • Community Moderate

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v4.43.4 — affected i
  • Vulnerabilities on record 57 over 4 years · 53 in the last year i
  • Latest disclosure 25 Aug 2026 i
  • Highest CVSS 9.3 i
  • With no published fix 3 i
  • Stars 7,018 i
  • OpenSSF scorecard 6/10 i
  • Last release 32 months ago i
  • Licence MIT i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/fleetdm/fleet/v4, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v4.0.0-20250305153625-7a7aebb82a8d 05 Mar 2025 H7 M18 L1 U27 MIT No Details →
v4.43.4 25 Jan 2024 H7 M18 L1 U27 Apache-2.0 No Details →
v4.28.1-0.20230602180307-893fbffb805f 02 Jun 2023 H7 M18 L1 U27 Apache-2.0 No Details →
v4.28.0 27 Feb 2023 H7 M18 L1 U27 Apache-2.0 No Details →
v4.1.1-0.20220919230005-c2cba7af7c6c 19 Sep 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220718172331-f30a31012ef8 18 Jul 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220718142547-2c2698913d0a 18 Jul 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220718141857-009d860076ca 18 Jul 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220717045621-17df96caa66b 17 Jul 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220715010144-1f8e55aed8fc 15 Jul 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220714205331-4c0791081b9a 14 Jul 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220511202919-69b4cbe1a2c5 11 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220511151224-d84d6008c32c 11 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220511131151-114b678e26ef 11 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220511023330-34a2d3e4834f 11 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220510022917-0cd65bb7c87b 10 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220510000814-a9ebb4bf4d2a 10 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220509212933-e04bfba195da 09 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220509191231-b1d2fff31aee 09 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220509190610-59a49c397e3e 09 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220509180605-62b3533e0fb8 09 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220509170837-418256fc41c1 09 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220509160853-4107f4df4000 09 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220509151800-e145aa180a73 09 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220506183028-4dd2e57d5bac 06 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220506173450-ed96be6e17f1 06 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220506163111-55d2cf1f10f0 06 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220506141304-63dd998dc177 06 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220506124139-36feff845667 06 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220506051927-09fc3f412761 06 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220506012906-c96f01b7f977 06 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220505211243-4bc8ec65690e 05 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220505195857-74b106a6c7c4 05 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220505192247-922da1592e12 05 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220505181353-998471f716ab 05 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220505171755-8fea14270cf2 05 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220505160935-a1d43e565029 05 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220505151535-adb1f53d63d5 05 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220505073833-8a2d25c703a5 05 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220505042103-767f4bc5d6d5 05 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220505030914-f10e142c2a3d 05 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220505015933-4100b6c90516 05 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220505001527-451020630809 05 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220504152726-3b9208c42a7a 04 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220504141412-b6bbbbe186fa 04 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220504130552-fba916e636fa 04 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220504020940-4531ec8b3960 04 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220504003956-cd046bf2fc8a 04 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220503225910-adc52d3bc0d8 03 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220503222646-3648bc38d0ac 03 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220503205708-6b34f32e8863 03 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220503194602-a5349672eb7f 03 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220503183043-45e6e1647b71 03 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220503165749-2aefcb385cef 03 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220503163043-24c57f1ce89b 03 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220503145111-e7b9f4109778 03 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20220503071348-0d53ac94bc93 03 May 2022 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20210812001311-451493b1ea38 12 Aug 2021 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20210811220137-e8def4af00b7 11 Aug 2021 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20210811215737-d88fac6b76ab 11 Aug 2021 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20210811215705-544652e83386 11 Aug 2021 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20210811213736-b2ee3bcb4b4a 11 Aug 2021 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20210811213134-dca5aac6e1ac 11 Aug 2021 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20210811203724-790d169e1430 11 Aug 2021 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20210811185753-ae2bd137b194 11 Aug 2021 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20210811175611-11dff7ca92ca 11 Aug 2021 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20210811175209-c78105861738 11 Aug 2021 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20210811164216-cf6f2152b62b 11 Aug 2021 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20210811163947-740ba7bc25a4 11 Aug 2021 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20210811161831-9ac3dcd1e7f5 11 Aug 2021 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20210811151459-63e598e59519 11 Aug 2021 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20210811144056-8bdad712d8b8 11 Aug 2021 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20210811140832-3b4bbf8f8ef7 11 Aug 2021 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20210811140222-989e638cc049 11 Aug 2021 H7 M18 L1 U27 MIT No Details →
v4.1.1-0.20210729011536-1d6572488be9 29 Jul 2021 H7 M18 L1 U27 — No Details →
v4.1.1-0.20210727220443-a188d0301575 27 Jul 2021 H7 M18 L1 U27 — No Details →
v4.1.1-0.20210727210616-da7925e1d75e 27 Jul 2021 H7 M18 L1 U27 — No Details →
v4.1.0 26 Jul 2021 H7 M18 L1 U27 — No Details →
v4.0.2-0.20210723145146-0c8537a1f9db 23 Jul 2021 H7 M18 L1 U27 — No Details →
v4.0.2-0.20210723123352-27303765cf87 23 Jul 2021 H7 M18 L1 U27 — No Details →
v4.0.2-0.20210722133825-15ef1e3d6ee3 22 Jul 2021 H7 M18 L1 U27 — No Details →
v4.0.2-0.20210722072158-39d55bf66a4e 22 Jul 2021 H7 M18 L1 U27 — No Details →
v4.0.2-0.20210720152425-55f2d370917c 20 Jul 2021 H7 M18 L1 U27 — No Details →
v4.0.2-0.20210720141953-080a7c468bbf 20 Jul 2021 H7 M18 L1 U27 — No Details →
v4.0.2-0.20210717001553-b705ad3c97f6 17 Jul 2021 H7 M18 L1 U27 — No Details →
v4.0.2-0.20210716205548-fc5ba6d12a5f 16 Jul 2021 H7 M18 L1 U27 — No Details →
v4.0.2-0.20210715233132-109dc8d8ce3e 15 Jul 2021 H7 M18 L1 U27 — No Details →
v4.0.2-0.20210715195512-6c2296591756 15 Jul 2021 H7 M18 L1 U27 — No Details →
v4.0.2-0.20210713192709-bd68c52a52e6 13 Jul 2021 H7 M18 L1 U27 — No Details →
v4.0.2-0.20210712213943-e6a01d755cc6 12 Jul 2021 H7 M18 L1 U27 — No Details →
v4.0.2-0.20210712171547-29e900d7c3ca 12 Jul 2021 H7 M18 L1 U27 — No Details →
v4.0.2-0.20210706200340-d9431e4da566 06 Jul 2021 H7 M18 L1 U27 — No Details →
v4.0.1 01 Jul 2021 H7 M18 L1 U27 — No Details →
v4.0.0 29 Jun 2021 H7 M18 L1 U27 — No Details →
v4.0.0-rc2.0.20210628181046-df2c45fee21a 28 Jun 2021 H7 M18 L1 U27 — No Details →

All 95 versions Vulert tracks for this package. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2022 2
  • 2025 2
  • 2026 53

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 53 of the 57 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/fleetdm/fleet/v4

The 5 most severe of 57 vulnerabilities recorded for this package

Search all 57 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2025-27509: Fleet SAML Authentication Vulnerability Leading to Unauthorized Access 9.3 critical 4.64.2 06 Mar 2025
CVE-2026-26061: Fleet Package Denial of Service Vulnerability Due to Unbounded Request Body Read 8.7 high 4.43.5-0.20260113202849-bbc1aef2987d 27 Mar 2026
CVE-2026-26062: Fleet Server Denial of Service Vulnerability in gRPC PublishLogs Endpoint 8.7 high 4.81.0 14 May 2026
CVE-2026-23998: Fleet Windows MDM Management Endpoint Authentication Bypass Vulnerability 8.2 high 4.81.0 14 May 2026
CVE-2026-24899: Fleet Windows MDM Azure AD JWT Authentication Bypass Vulnerability 8.2 high 4.82.0 14 May 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/fleetdm/fleet/v4

Is github.com/fleetdm/fleet/v4 safe to use?

Vulert records 57 vulnerabilities for github.com/fleetdm/fleet/v4 in Go: 1 critical, 7 high, 18 medium and 1 low, plus 30 not yet rated. 3 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/fleetdm/fleet/v4's Vulert package health score?

Vulert scores github.com/fleetdm/fleet/v4 57/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of github.com/fleetdm/fleet/v4 affected?

Yes. v4.43.4, the version you would install today, has 53 known vulnerabilities, and 3 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

Which version of github.com/fleetdm/fleet/v4 should I use?

v4.43.4 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/fleetdm/fleet/v4 have?

57 vulnerabilities are recorded for github.com/fleetdm/fleet/v4 in the Go ecosystem: 1 critical, 7 high, 18 medium and 1 low, plus 30 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/fleetdm/fleet/v4 vulnerabilities disclosed?

53 vulnerabilities were recorded for github.com/fleetdm/fleet/v4 in the last 12 months, and the oldest entry in this database dates to 07 Feb 2022. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/fleetdm/fleet/v4 are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/fleetdm/fleet/v4 for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/fleetdm/fleet/v4 version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.