Fleetdm
Monthly
Unauthenticated denial of service in FleetDM Fleet before 4.83.0 allows remote attackers to exhaust server memory by sending small, highly gzip-compressed HTTP request bodies to unauthenticated endpoints, where decoding expands them and crashes the entire Fleet instance. No credentials, user interaction, or special configuration are required beyond network reachability, so internet-exposed Fleet servers are the highest priority. No public exploit code or CISA KEV active-exploitation entry was identified at time of analysis, but the low attack complexity and unauthenticated path make this a credible availability threat.
Unauthenticated denial-of-service in Fleet Device Management before 4.89.0 allows remote attackers to crash the server by sending a crafted binary property list to Apple MDM enrollment endpoints. The payload, roughly 150 bytes, triggers unbounded recursion or exponential allocation that exhausts CPU and memory. Exploitation requires Apple MDM enrollment to be configured and the enrollment endpoints to be network-reachable; impact is availability-only, with no data access or code execution, and no public exploit identified at time of analysis.
Unauthenticated attackers can bypass authentication in Fleet (versions before 4.87.0) by using non-secret device identifiers like hostnames or hardware serials as tokens, allowing them to impersonate iOS/iPadOS hosts, read device data, and trigger device-scoped actions such as software installation and MDM migration. Exploitation requires knowledge of a valid identifier but no privileges or user interaction; no public exploit code has been identified at time of analysis. This is a high-priority vulnerability (CVSS 9.3) with a vendor patch available in version 4.87.0.
OS command injection in Fleet's generator for Fleet-maintained macOS app install and uninstall scripts allows crafted Homebrew cask metadata containing shell metacharacters such as $(...) to be carried unescaped into scripts that run as root on managed macOS hosts. Manifests generated before 2026-08-19 are affected; the flaw is a supply-chain vector because the attacker needs no Fleet credentials, only the ability to land crafted metadata in an upstream Homebrew cask that must then survive both upstream Homebrew cask review and Fleet's review of the automated ingestion pull request before a managed host installs or uninstalls the app. The vendor CVSS 4.0 base is 8.9, but the vendor's own vector is PR:H while CERT's independent assessment scores it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, and the two independent review gates plus central, pre-built manifest distribution on 2026-08-19 sharply limit real-world exploitability; no public exploit code has been identified and there is no confirmed active exploitation (not in CISA KEV), so exploitation is assessed as difficult rather than imminent.
SQL injection in Fleet device management software before version 4.80.1 allows authenticated users to manipulate the order_key parameter and inject arbitrary SQL commands through improper identifier handling in ORDER BY clauses. An attacker with valid credentials can exploit this vulnerability to perform blind SQL injection attacks, potentially extracting sensitive database information or causing denial of service through resource exhaustion. No patch is currently available for this high-severity vulnerability affecting MySQL implementations.
Fleet device management software has a signature verification bypass that allows attackers to install malicious firmware on managed devices across the fleet.
Fleet device management software versions prior to 4.78.3 suffer from broken access control that permits any authenticated user, including low-privilege observers, to access debug and profiling endpoints. Attackers can leverage this vulnerability to extract sensitive server diagnostics, runtime profiling data, and application state, or trigger CPU-intensive operations resulting in denial of service. The vulnerability affects multiple Fleet versions and has patches available.
Team-scoped users in Fleet DM before 4.89.0 can read MDM command results for hosts on other teams via the commands/results endpoint when a shared command UUID targets hosts across multiple teams, exposing host UUIDs, command payloads, and device responses. Exploitation requires an authenticated low-privileged team-scoped account on an instance with MDM features in use, and the disclosure is limited to results tied to such cross-team command UUIDs; there is no public exploit identified at time of analysis. CVSS 4.0 base score is 5.3, with an assessed CVSS 3.1 base score of 4.3 reflecting read-only low confidentiality impact.
Unauthenticated download of in-house iOS application packages and manifests is possible against enterprise-tier Fleet deployments running versions before 4.87.0, because two sessionless MDM endpoints were shipped without the intended random, time-limited URL token, letting anyone with network reach to the Fleet server fetch IPA binaries and their metadata (bundle identifier, version, name) by guessing sequential title identifiers. Impact is confined to read-only information disclosure - there is no privilege escalation or write access, the free tier is unaffected (it returns fleet.ErrMissingLicense), and hosts not managed by Fleet are untouched. The vendor CVSS 4.0 score is 6.9 (MEDIUM) while our independently assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N; no public exploit code or confirmed active exploitation was identified at time of analysis.
SQL injection in FleetDM Fleet before 4.89.0 allows an authenticated user holding read access to Activity to influence the ORDER BY clause on the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities), because the deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key without an allowlist. The impact is read-only and tightly bounded: it acts as a blind sort-order oracle that can only infer values from columns on the activity_past table (e.g. details) that are not otherwise returned, with no write access, no privilege escalation, and no reachability of node_key or host-join columns through these endpoints. Exploitation requires authenticated access plus high attack complexity due to the indirect inference, no public exploit code was identified at time of analysis, and the issue is fixed in 4.89.0.
Fleet device management software versions prior to 4.81.1 allow malicious enrolled Windows devices to access Mobile Device Management (MDM) commands intended for other devices, potentially disclosing sensitive configuration data including WiFi credentials, VPN secrets, and certificate payloads across the entire Windows fleet. The vulnerability stems from improper authorization controls in Windows MDM command processing, affecting any organization using Fleet for Windows device management. Vendor-released patch: version 4.81.1.
Fleet device management software prior to version 4.81.0 allows privilege escalation through email validation bypass in the user invitation flow. An attacker with a valid invite token can create an account using an arbitrary email address while retaining the role permissions granted by the invite, potentially obtaining global admin access. No public exploit code or active exploitation has been identified at the time of analysis.
Denial-of-service vulnerability in Fleet device management software prior to version 4.81.0 allows authenticated hosts to crash the entire Fleet server process by sending a malformed log type value to the gRPC Launcher endpoint, disrupting all connected devices, MDM enrollments, and API consumers. The vulnerability requires prior authentication but affects availability across the entire infrastructure. Vendor-released patch: version 4.81.0.
Fleet device management software versions prior to 4.81.1 are vulnerable to command injection in the software installer pipeline, enabling remote attackers with high privileges to achieve arbitrary code execution as root on macOS/Linux or SYSTEM on Windows when triggering uninstall operations on crafted software packages. The vulnerability requires high privileges and user interaction but delivers complete system compromise on affected managed hosts. No public exploit code or active exploitation has been identified at time of analysis.
SQL injection in Fleet device management software versions prior to 4.81.0 allows authenticated Team Admin or Global Admin users to execute arbitrary SQL queries against the Fleet database via the MDM bootstrap package configuration API endpoint. Attackers with these privileges can exfiltrate sensitive data, modify arbitrary team configurations, and inject malicious content into team settings. The vulnerability requires authentication but poses significant risk to multi-tenant Fleet deployments where administrative credentials may be compromised or where insider threats exist.
SQL injection in Fleet's Apple MDM profile delivery pipeline before version 4.81.0 allows authenticated attackers with valid MDM enrollment certificates to exfiltrate or modify database contents, including user credentials, API tokens, and device enrollment secrets. This second-order SQL injection vulnerability affects the cpe:2.3:a:fleetdm:fleet product line and requires valid MDM enrollment credentials to exploit, limiting the attack surface to adversaries who have already established trust within the MDM enrollment process. No public exploit code or active exploitation has been identified at the time of this analysis.
Fleet device management software versions prior to 4.81.1 contain a broken access control vulnerability in the host transfer API that allows authenticated team maintainers to transfer hosts from any team into their own team, circumventing team isolation boundaries and gaining full control over stolen hosts including root-level script execution capabilities. The vulnerability requires authenticated access (PR:L in CVSS vector) but presents high integrity impact due to the ability to execute privileged commands on managed endpoints. No public exploit code or active exploitation has been confirmed at time of analysis.
Fleet versions up to 4.80.1 contains a vulnerability that allows attackers to unauthorized access to Google Calendar resources associated with the service acc (CVSS 6.5).
Fleet device management software versions before 4.80.1 contain an authorization bypass in the certificate template deletion API that allows team administrators to delete certificate templates belonging to other teams. The vulnerability stems from insufficient validation of template ownership during batch deletion operations, enabling cross-team resource destruction that could disrupt certificate-dependent functions like device enrollment and VPN access. A patch is not yet available as of this CVE publication.
Fleet's Android MDM Pub/Sub endpoint fails to authenticate requests prior to version 4.80.1, allowing unauthenticated attackers to remotely trigger device unenrollment and remove Android devices from management. The vulnerability has limited impact, affecting only device management continuity without providing access to Fleet itself or device data. Organizations running vulnerable versions should upgrade immediately or disable Android MDM until patching is possible.
Fleet's device lock and wipe PIN generation relies on predictable timestamps without additional entropy, allowing attackers with physical access to a locked device and knowledge of the approximate lock time to brute-force the 6-digit PIN within a limited search window. This vulnerability affects Fleet versions prior to 4.80.1 and requires local access and timing knowledge to exploit. No patch is currently available.
fleetdm/fleet is open source device management software. [CVSS 5.4 MEDIUM]
fleetdm/fleet is an open source device management, built on osquery. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Fleet is an open source osquery manager. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Unauthenticated denial of service in FleetDM Fleet before 4.83.0 allows remote attackers to exhaust server memory by sending small, highly gzip-compressed HTTP request bodies to unauthenticated endpoints, where decoding expands them and crashes the entire Fleet instance. No credentials, user interaction, or special configuration are required beyond network reachability, so internet-exposed Fleet servers are the highest priority. No public exploit code or CISA KEV active-exploitation entry was identified at time of analysis, but the low attack complexity and unauthenticated path make this a credible availability threat.
Unauthenticated denial-of-service in Fleet Device Management before 4.89.0 allows remote attackers to crash the server by sending a crafted binary property list to Apple MDM enrollment endpoints. The payload, roughly 150 bytes, triggers unbounded recursion or exponential allocation that exhausts CPU and memory. Exploitation requires Apple MDM enrollment to be configured and the enrollment endpoints to be network-reachable; impact is availability-only, with no data access or code execution, and no public exploit identified at time of analysis.
Unauthenticated attackers can bypass authentication in Fleet (versions before 4.87.0) by using non-secret device identifiers like hostnames or hardware serials as tokens, allowing them to impersonate iOS/iPadOS hosts, read device data, and trigger device-scoped actions such as software installation and MDM migration. Exploitation requires knowledge of a valid identifier but no privileges or user interaction; no public exploit code has been identified at time of analysis. This is a high-priority vulnerability (CVSS 9.3) with a vendor patch available in version 4.87.0.
OS command injection in Fleet's generator for Fleet-maintained macOS app install and uninstall scripts allows crafted Homebrew cask metadata containing shell metacharacters such as $(...) to be carried unescaped into scripts that run as root on managed macOS hosts. Manifests generated before 2026-08-19 are affected; the flaw is a supply-chain vector because the attacker needs no Fleet credentials, only the ability to land crafted metadata in an upstream Homebrew cask that must then survive both upstream Homebrew cask review and Fleet's review of the automated ingestion pull request before a managed host installs or uninstalls the app. The vendor CVSS 4.0 base is 8.9, but the vendor's own vector is PR:H while CERT's independent assessment scores it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, and the two independent review gates plus central, pre-built manifest distribution on 2026-08-19 sharply limit real-world exploitability; no public exploit code has been identified and there is no confirmed active exploitation (not in CISA KEV), so exploitation is assessed as difficult rather than imminent.
SQL injection in Fleet device management software before version 4.80.1 allows authenticated users to manipulate the order_key parameter and inject arbitrary SQL commands through improper identifier handling in ORDER BY clauses. An attacker with valid credentials can exploit this vulnerability to perform blind SQL injection attacks, potentially extracting sensitive database information or causing denial of service through resource exhaustion. No patch is currently available for this high-severity vulnerability affecting MySQL implementations.
Fleet device management software has a signature verification bypass that allows attackers to install malicious firmware on managed devices across the fleet.
Fleet device management software versions prior to 4.78.3 suffer from broken access control that permits any authenticated user, including low-privilege observers, to access debug and profiling endpoints. Attackers can leverage this vulnerability to extract sensitive server diagnostics, runtime profiling data, and application state, or trigger CPU-intensive operations resulting in denial of service. The vulnerability affects multiple Fleet versions and has patches available.
Team-scoped users in Fleet DM before 4.89.0 can read MDM command results for hosts on other teams via the commands/results endpoint when a shared command UUID targets hosts across multiple teams, exposing host UUIDs, command payloads, and device responses. Exploitation requires an authenticated low-privileged team-scoped account on an instance with MDM features in use, and the disclosure is limited to results tied to such cross-team command UUIDs; there is no public exploit identified at time of analysis. CVSS 4.0 base score is 5.3, with an assessed CVSS 3.1 base score of 4.3 reflecting read-only low confidentiality impact.
Unauthenticated download of in-house iOS application packages and manifests is possible against enterprise-tier Fleet deployments running versions before 4.87.0, because two sessionless MDM endpoints were shipped without the intended random, time-limited URL token, letting anyone with network reach to the Fleet server fetch IPA binaries and their metadata (bundle identifier, version, name) by guessing sequential title identifiers. Impact is confined to read-only information disclosure - there is no privilege escalation or write access, the free tier is unaffected (it returns fleet.ErrMissingLicense), and hosts not managed by Fleet are untouched. The vendor CVSS 4.0 score is 6.9 (MEDIUM) while our independently assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N; no public exploit code or confirmed active exploitation was identified at time of analysis.
SQL injection in FleetDM Fleet before 4.89.0 allows an authenticated user holding read access to Activity to influence the ORDER BY clause on the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities), because the deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key without an allowlist. The impact is read-only and tightly bounded: it acts as a blind sort-order oracle that can only infer values from columns on the activity_past table (e.g. details) that are not otherwise returned, with no write access, no privilege escalation, and no reachability of node_key or host-join columns through these endpoints. Exploitation requires authenticated access plus high attack complexity due to the indirect inference, no public exploit code was identified at time of analysis, and the issue is fixed in 4.89.0.
Fleet device management software versions prior to 4.81.1 allow malicious enrolled Windows devices to access Mobile Device Management (MDM) commands intended for other devices, potentially disclosing sensitive configuration data including WiFi credentials, VPN secrets, and certificate payloads across the entire Windows fleet. The vulnerability stems from improper authorization controls in Windows MDM command processing, affecting any organization using Fleet for Windows device management. Vendor-released patch: version 4.81.1.
Fleet device management software prior to version 4.81.0 allows privilege escalation through email validation bypass in the user invitation flow. An attacker with a valid invite token can create an account using an arbitrary email address while retaining the role permissions granted by the invite, potentially obtaining global admin access. No public exploit code or active exploitation has been identified at the time of analysis.
Denial-of-service vulnerability in Fleet device management software prior to version 4.81.0 allows authenticated hosts to crash the entire Fleet server process by sending a malformed log type value to the gRPC Launcher endpoint, disrupting all connected devices, MDM enrollments, and API consumers. The vulnerability requires prior authentication but affects availability across the entire infrastructure. Vendor-released patch: version 4.81.0.
Fleet device management software versions prior to 4.81.1 are vulnerable to command injection in the software installer pipeline, enabling remote attackers with high privileges to achieve arbitrary code execution as root on macOS/Linux or SYSTEM on Windows when triggering uninstall operations on crafted software packages. The vulnerability requires high privileges and user interaction but delivers complete system compromise on affected managed hosts. No public exploit code or active exploitation has been identified at time of analysis.
SQL injection in Fleet device management software versions prior to 4.81.0 allows authenticated Team Admin or Global Admin users to execute arbitrary SQL queries against the Fleet database via the MDM bootstrap package configuration API endpoint. Attackers with these privileges can exfiltrate sensitive data, modify arbitrary team configurations, and inject malicious content into team settings. The vulnerability requires authentication but poses significant risk to multi-tenant Fleet deployments where administrative credentials may be compromised or where insider threats exist.
SQL injection in Fleet's Apple MDM profile delivery pipeline before version 4.81.0 allows authenticated attackers with valid MDM enrollment certificates to exfiltrate or modify database contents, including user credentials, API tokens, and device enrollment secrets. This second-order SQL injection vulnerability affects the cpe:2.3:a:fleetdm:fleet product line and requires valid MDM enrollment credentials to exploit, limiting the attack surface to adversaries who have already established trust within the MDM enrollment process. No public exploit code or active exploitation has been identified at the time of this analysis.
Fleet device management software versions prior to 4.81.1 contain a broken access control vulnerability in the host transfer API that allows authenticated team maintainers to transfer hosts from any team into their own team, circumventing team isolation boundaries and gaining full control over stolen hosts including root-level script execution capabilities. The vulnerability requires authenticated access (PR:L in CVSS vector) but presents high integrity impact due to the ability to execute privileged commands on managed endpoints. No public exploit code or active exploitation has been confirmed at time of analysis.
Fleet versions up to 4.80.1 contains a vulnerability that allows attackers to unauthorized access to Google Calendar resources associated with the service acc (CVSS 6.5).
Fleet device management software versions before 4.80.1 contain an authorization bypass in the certificate template deletion API that allows team administrators to delete certificate templates belonging to other teams. The vulnerability stems from insufficient validation of template ownership during batch deletion operations, enabling cross-team resource destruction that could disrupt certificate-dependent functions like device enrollment and VPN access. A patch is not yet available as of this CVE publication.
Fleet's Android MDM Pub/Sub endpoint fails to authenticate requests prior to version 4.80.1, allowing unauthenticated attackers to remotely trigger device unenrollment and remove Android devices from management. The vulnerability has limited impact, affecting only device management continuity without providing access to Fleet itself or device data. Organizations running vulnerable versions should upgrade immediately or disable Android MDM until patching is possible.
Fleet's device lock and wipe PIN generation relies on predictable timestamps without additional entropy, allowing attackers with physical access to a locked device and knowledge of the approximate lock time to brute-force the 6-digit PIN within a limited search window. This vulnerability affects Fleet versions prior to 4.80.1 and requires local access and timing knowledge to exploit. No patch is currently available.
fleetdm/fleet is open source device management software. [CVSS 5.4 MEDIUM]
fleetdm/fleet is an open source device management, built on osquery. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Fleet is an open source osquery manager. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.