GHSA-52jx-g6m5-h735 CVE-2025-27509 GO-2025-3505
Fleet has SAML authentication vulnerability due to improper SAML response validation
- Severity
- 0.0 / 10
- Critical · CVSS 4.0
- Exploit chance (EPSS)
- 0.67%
- Chance of exploitation in the next 30 days. Higher than 51.96% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-285 Improper Authorization
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- Fix
4.64.2- Upgrade github.com/fleetdm/fleet/v4 to this version or later
Description
Summary
A vulnerability in Fleet’s SAML authentication handling could allow an attacker to forge authentication assertions and gain unauthorized access to Fleet. In certain configurations, this could result in the creation of new user accounts, including administrative accounts. This issue affects Fleet deployments using single sign-on (SSO).
Impact
In vulnerable versions of Fleet, an attacker could craft a specially-formed SAML response to:
- Forge authentication assertions, potentially impersonating legitimate users.
- If Just-In-Time (JIT) provisioning is enabled, the attacker could provision a new administrative user account.
- If MDM enrollment is enabled, certain endpoints could be used to create new accounts tied to forged assertions.
This could allow unauthorized access to Fleet, including administrative access, visibility into device data, and modification of configuration.
Patches
This issue is addressed in commit fc96cc4 and is available in Fleet version 4.64.2.
The following backport versions also address this issue:
- 4.63.2
- 4.62.4
- 4.58.1
- 4.53.2
Workarounds
If an immediate upgrade is not possible, Fleet users should temporarily disable single-sign-on (SSO) and use password authentication.
Credit
Thank you @hakivvi, as well as Jeffrey Hofmann and Colby Morgan from the Robinhood Red Team for finding and reporting this vulnerability using our responsible disclosure process.
For more information
If you have any questions or comments about this advisory:
- Email us at security@fleetdm.com
- Join #fleet in osquery Slack
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/fleetdm/fleet/v4 | >= 4.64.0, < 4.64.2 |
4.64.2 |
| github.com/fleetdm/fleet/v4 | >= 4.63.0, < 4.63.2 |
4.63.2 |
| github.com/fleetdm/fleet/v4 | >= 4.62.0, < 4.62.4 |
4.62.4 |
| github.com/fleetdm/fleet/v4 | >= 4.54.0, < 4.58.1 |
4.58.1 |
| github.com/fleetdm/fleet/v4 | < 4.53.2 |
4.53.2 |
| github.com/fleetdm/fleet/v4 | all versions |
No fix yet |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/fleetdm/fleet/v4 Go → 4.64.2
- go
go get github.com/fleetdm/fleet/v4@v4.64.2 && go mod tidy
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
Weakness
CWE-285: Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
How to prevent it
- Architecture and Design: Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
- Architecture and Design: Ensure that you perform access control checks related to your business logic. These checks may be different than the access control checks that you apply to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor.
- Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
- Architecture and Design: For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page. One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
- System Configuration, Installation: Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
How to prevent it
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-rxhg-vcww-2mpw Fleet: ORDER BY column injection on activity list endpoints | Low | Also affects github.com/fleetdm/fleet/v4 |
| GHSA-q9c5-pp7m-fm2g Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs | Medium | Also affects github.com/fleetdm/fleet/v4 |
| GO-2026-6264 Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database | High | Also affects github.com/fleetdm/fleet/v4 |
| GHSA-88p2-jj8w-j8qg Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint | Medium | Also affects github.com/fleetdm/fleet/v4 |
| GHSA-gm7f-v959-fr2g Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint | Medium | Also affects github.com/fleetdm/fleet/v4 |
| GHSA-x4qr-qw6h-wvxq Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint | Medium | Also affects github.com/fleetdm/fleet/v4 |
| GHSA-vxm7-9x8v-8gm4 Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint | Medium | Also affects github.com/fleetdm/fleet/v4 |
| GHSA-mxmp-wr3w-rvqx Fleet: IP spoofing allows bypassing API rate limiting | High | Also affects github.com/fleetdm/fleet/v4 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor