VulertSecurity VulertSecurity

Vulnerability Database · Go · github.com/fleetdm/fleet/v4 · Version

github.com/fleetdm/fleet/v4 v4.0.0

v4.0.0 is affected by 53 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: v4.43.4.

Critical 0 High 7 Medium 18 Low 1 Unrated 27

All github.com/fleetdm/fleet/v4 versions & vulnerabilities → Source repository Search the database for this package →
Released 29 Jun 2021 Licence MIT Also known from other sources 56 Newer releases 95 Database updated 23/Oct/2026

Release and licence data published by the Go module proxy. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

github.com/fleetdm/fleet/v4 v4.0.0 vulnerabilities

53 vulnerabilities cover github.com/fleetdm/fleet/v4 v4.0.0. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2026-26062: Fleet Server Denial of Service Vulnerability in gRPC PublishLogs Endpoint 8.7 high 4.81.0 14 May 2026
CVE-2026-26061: Fleet Package Denial of Service Vulnerability Due to Unbounded Request Body Read 8.7 high 4.43.5-0.20260113202849-bbc1aef2987d 27 Mar 2026
CVE-2026-24899: Fleet Windows MDM Azure AD JWT Authentication Bypass Vulnerability 8.2 high 4.82.0 14 May 2026
CVE-2026-23998: Fleet Windows MDM Management Endpoint Authentication Bypass Vulnerability 8.2 high 4.81.0 14 May 2026
CVE-2026-27806: Local Privilege Escalation in Fleet via Tcl Command Injection 7.8 high 4.81.1 08 Apr 2026
CVE-2026-27465: Fleet Vulnerability Exposes Google Calendar Credentials to Low-Privileged Users 7.1 high 4.80.1 26 Feb 2026
CVE-2026-24000: Fleet Package Rate Limiting Bypass via Untrusted Client IP Headers 6.9 medium 4.80.1 14 May 2026
CVE-2026-34388: Fleet Denial of Service Vulnerability via Unhandled gRPC Log Type 6.6 medium 4.81.0 30 Mar 2026
CVE-2026-48786: Fleet Package Exposes Sensitive Team Configuration to Observer-Class Users 6.5 medium 4.87.0 12 Aug 2026
CVE-2026-46371: Fleet Vulnerability Allows Observer Role to Extract Sensitive Data via Apple MDM Commands Endpoint 6.5 medium 4.84.2 12 Jun 2026
CVE-2026-46370: Fleet Package Observer-Level Enrollment Secret Extraction Vulnerability 6.5 medium 4.84.2 12 Jun 2026
CVE-2026-34386: SQL Injection Vulnerability in Fleet's MDM Bootstrap Package 6.3 medium 4.81.0 30 Mar 2026
CVE-2026-24004: Fleet Android MDM Unauthenticated Device Disenrollment Vulnerability 6.3 medium 4.80.1 26 Feb 2026
CVE-2026-34385: Fleet's Apple MDM Profile Delivery Vulnerability Leading to SQL Injection 6.2 medium 4.81.0 30 Mar 2026
CVE-2026-26191: Fleet Package Installer OS Command Injection Vulnerability 6.0 medium 4.81.1 14 May 2026
CVE-2026-26060: Fleet Package Password Reset Token Vulnerability 6.0 medium 4.43.5-0.20260113202849-bbc1aef2987d 27 Mar 2026
Unauthenticated Download Vulnerability in Fleet Package: Exposing In-House iOS App Binaries 5.3 medium 4.87.0 20 Aug 2026
CVE-2022-23600: Limited ability to spoof SAML authentication in Fleet 5.3 medium 4.9.1 07 Feb 2022
CVE-2026-26186: SQL Injection Vulnerability in Fleet's Software Versions API 5.1 medium 4.80.1 26 Feb 2026
CVE-2026-25963: Fleet Package Authorization Bypass in Certificate Template Deletion 5.0 medium 4.80.1 26 Feb 2026
CVE-2026-34389: Fleet User Account Creation Vulnerability via Invite Email Address 4.9 medium 4.81.0 30 Mar 2026
CVE-2026-29180: Fleet Package Host Transfer Vulnerability Allows Unauthorized Host Transfers 4.9 medium 4.81.1 27 Mar 2026
CVE-2026-41262: Fleet DM Global Policy Data Exposure Vulnerability 4.3 medium 4.85.0 26 Jun 2026
CVE-2026-23999: Fleet Device Lock PIN Predictability Vulnerability 4.1 medium 4.80.1 26 Feb 2026
Column Injection Vulnerability in Fleet Package: ORDER BY Manipulation Risk 3.1 low 4.89.0 20 Aug 2026
CVE-2026-54245: SQL Injection Vulnerability in Fleet Package Allows Database Compromise N/A unrated 4.86.2 25 Aug 2026
Unauthenticated Download Vulnerability in Fleet Package: Predictable URLs Expose iOS App Binaries N/A unrated 4.87.0 25 Aug 2026
Column Injection Vulnerability in Fleet Package: ORDER BY Column Injection on Activity List Endpoints N/A unrated 4.89.0 25 Aug 2026
CVE-2026-48786: Fleet Package Vulnerability Allows Observer-Class Users to Access Sensitive Configuration Data N/A unrated 4.87.0 18 Aug 2026
CVE-2026-41262: Fleet DM Cross-Team Policy Data Exposure Vulnerability N/A unrated 4.85.0 07 Jul 2026
CVE-2026-27806: Local Privilege Escalation in Fleet Due to Tcl Command Injection N/A unrated 4.81.1 25 Jun 2026
CVE-2026-46370: Fleet Package Vulnerability Leading to Observer-Level Enrollment Secret Extraction N/A unrated 4.84.2 25 Jun 2026
CVE-2026-46371: github.com/fleetdm/fleet - Observer-level Enrollment Secret Extraction Vulnerability N/A unrated 4.84.2 25 Jun 2026
CVE-2026-26062: Unexpected Termination in Fleet Server due to gRPC Request Handling N/A unrated 4.81.0 25 Jun 2026
CVE-2026-46356: IP Spoofing Vulnerability in github.com/fleetdm/fleet Allows API Rate Limiting Bypass N/A unrated 4.80.1 25 Jun 2026
CVE-2026-24000: Rate Limiting Bypass in Fleet Package N/A unrated 4.80.1 25 Jun 2026
CVE-2026-26191: OS Command Injection Vulnerability in Fleet Package N/A unrated 4.81.1 25 Jun 2026
CVE-2026-24899: Azure AD JWT Authentication Bypass in Fleet Windows MDM N/A unrated 4.82.0 25 Jun 2026
CVE-2026-23998: Authentication Bypass in github.com/fleetdm/fleet/v4 Windows MDM Management Endpoint N/A unrated 4.81.0 26 May 2026
CVE-2026-34388: Denial of Service Vulnerability in github.com/fleetdm/fleet Package N/A unrated 4.81.0 02 Apr 2026
CVE-2026-34385: SQL Injection Vulnerability in Fleet's Apple MDM Profile Delivery N/A unrated 4.81.0 02 Apr 2026
CVE-2026-34386: SQL Injection Vulnerability in github.com/fleetdm/fleet Package N/A unrated 4.81.0 02 Apr 2026
CVE-2026-34389: Vulnerability in github.com/fleetdm/fleet - User Account Creation via Invite Lacks Email Enforcement N/A unrated 4.81.0 02 Apr 2026
CVE-2026-29180: Fleet Package Vulnerability Allows Unauthorized Host Transfers N/A unrated 4.81.1 02 Apr 2026
CVE-2026-26061: Remote Denial of Service in github.com/fleetdm/fleet due to Unbounded Request Body Read N/A unrated No fix published 02 Apr 2026
CVE-2026-26060: Fleet Package Password Reset Token Vulnerability N/A unrated No fix published 02 Apr 2026
CVE-2026-23999: Predictable Device Lock PIN in Fleet Package N/A unrated 4.80.1 27 Feb 2026
CVE-2026-24004: Unauthenticated Android Device Disenrollment Vulnerability in Fleet Package N/A unrated 4.80.1 27 Feb 2026
CVE-2026-25963: Authorization Bypass in github.com/fleetdm/fleet Certificate Template Batch Deletion N/A unrated 4.80.1 27 Feb 2026
CVE-2026-27465: Fleet Package Exposes Sensitive Google Calendar Credentials to Low-Privileged Users N/A unrated 4.80.1 27 Feb 2026
CVE-2026-26186: SQL Injection Vulnerability in Fleet's ORDER BY Parameter N/A unrated 4.80.1 27 Feb 2026
CVE-2025-27509: SAML Authentication Vulnerability in Fleet Package N/A unrated No fix published 10 Mar 2025
CVE-2020-26276: SAML authentication vulnerability in github.com/fleetdm/fleet/v4 N/A high 3.5.1 11 Feb 2022

Looking for another version, or everything Vulert holds for github.com/fleetdm/fleet/v4?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/fleetdm/fleet/v4 v4.0.0

Is github.com/fleetdm/fleet/v4 v4.0.0 vulnerable?

Yes. 53 vulnerabilities in the Vulert database cover github.com/fleetdm/fleet/v4 v4.0.0: 0 critical, 7 high, 18 medium and 1 low, plus 27 not yet rated. The upgrade Vulert recommends is v4.43.4, and each entry above names the fixed version to move to.

Which version of github.com/fleetdm/fleet/v4 should I use instead of v4.0.0?

v4.43.4 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is v4.0.0 the latest release of github.com/fleetdm/fleet/v4?

No. v4.0.0 was published 29 Jun 2021, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor github.com/fleetdm/fleet/v4 for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/fleetdm/fleet/v4 version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.