GHSA-w3wf-cfx3-6gcx CVE-2020-26276
SAML authentication vulnerability due to stdlib XML parsing
- Severity
- High
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- 2.20%
- Chance of exploitation in the next 30 days. Higher than 82.47% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-290 Authentication Bypass by Spoofing
- Fix
3.5.1- Upgrade github.com/fleetdm/fleet/v4 to this version or later
Description
Impact
Due to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from a SAML IdP.
Users that configure Fleet with SSO login may be vulnerable to this issue.
Patches
This issue is patched in 3.5.1 using https://github.com/mattermost/xml-roundtrip-validator.
Workarounds
If upgrade to 3.5.1 is not possible, users should disable SSO authentication in Fleet.
References
See https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/ for more information about the underlying vulnerabilities.
For more information
If you have any questions or comments about this advisory:
- Email us at security@fleetdm.com
- Join #fleet in osquery Slack
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/fleetdm/fleet/v4 | < 3.5.1 |
3.5.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/fleetdm/fleet/v4 Go → 3.5.1
- go
go get github.com/fleetdm/fleet/v4@v3.5.1 && go mod tidy
Weakness
CWE-290: Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
References
Advisories
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-rxhg-vcww-2mpw Fleet: ORDER BY column injection on activity list endpoints | Low | Also affects github.com/fleetdm/fleet/v4 |
| GHSA-q9c5-pp7m-fm2g Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs | Medium | Also affects github.com/fleetdm/fleet/v4 |
| GO-2026-6264 Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database | High | Also affects github.com/fleetdm/fleet/v4 |
| GHSA-88p2-jj8w-j8qg Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint | Medium | Also affects github.com/fleetdm/fleet/v4 |
| GHSA-gm7f-v959-fr2g Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint | Medium | Also affects github.com/fleetdm/fleet/v4 |
| GHSA-x4qr-qw6h-wvxq Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint | Medium | Also affects github.com/fleetdm/fleet/v4 |
| GHSA-vxm7-9x8v-8gm4 Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint | Medium | Also affects github.com/fleetdm/fleet/v4 |
| GHSA-mxmp-wr3w-rvqx Fleet: IP spoofing allows bypassing API rate limiting | High | Also affects github.com/fleetdm/fleet/v4 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor