GO-2026-4335 CVE-2026-23518 GHSA-63m5-974w-448v
Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment in github.com/fleetdm/fleet
- Severity
- 0.0 / 10
- Critical · CVSS 4.0
- Exploit chance (EPSS)
- 0.25%
- Chance of exploitation in the next 30 days. Higher than 17.04% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-347 Improper Verification of Cryptographic Signature
- Fix
- Available
- 2 packages have a fixed version
Description
Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment in github.com/fleetdm/fleet
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/fleetdm/fleet | >= 4.78.0, < 4.78.3 |
4.78.3 |
| github.com/fleetdm/fleet | >= 4.77.0, < 4.77.1 |
4.77.1 |
| github.com/fleetdm/fleet | >= 4.76.0, < 4.76.2 |
4.76.2 |
| github.com/fleetdm/fleet | >= 4.75.0, < 4.75.2 |
4.75.2 |
| github.com/fleetdm/fleet | < 4.43.5-0.20260112202845-e225ef57912c |
4.43.5-0.20260112202845-e225ef57912c |
| github.com/fleetdm/fleet/v4 | >= 4.75.0, < 4.75.2>= 4.76.0, < 4.76.2>= 4.77.0, < 4.77.1>= 4.78.0, < 4.78.3 |
4.75.24.76.24.77.14.78.3 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/fleetdm/fleet Go → 4.78.3
- go
go get github.com/fleetdm/fleet@v4.78.3 && go mod tidy
github.com/fleetdm/fleet/v4 Go → 4.78.3
- go
go get github.com/fleetdm/fleet/v4@v4.78.3 && go mod tidy
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-347: Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-rxhg-vcww-2mpw Fleet: ORDER BY column injection on activity list endpoints | Low | Also affects github.com/fleetdm/fleet/v4 |
| GHSA-q9c5-pp7m-fm2g Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs | Medium | Also affects github.com/fleetdm/fleet/v4 |
| GO-2026-6264 Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database | High | Also affects github.com/fleetdm/fleet |
| GHSA-88p2-jj8w-j8qg Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint | Medium | Also affects github.com/fleetdm/fleet/v4 |
| GHSA-gm7f-v959-fr2g Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint | Medium | Also affects github.com/fleetdm/fleet/v4 |
| GHSA-x4qr-qw6h-wvxq Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint | Medium | Also affects github.com/fleetdm/fleet/v4 |
| GHSA-vxm7-9x8v-8gm4 Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint | Medium | Also affects github.com/fleetdm/fleet/v4 |
| GHSA-mxmp-wr3w-rvqx Fleet: IP spoofing allows bypassing API rate limiting | High | Also affects github.com/fleetdm/fleet/v4 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor