github.com/fleetdm/fleet (Go)
Advisories
14
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 4.86.2 or later clears every advisory below that has a fix.
Upgrade commands
go
go get github.com/fleetdm/fleet@v4.86.2 && go mod tidyKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GO-2026-6264 Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database |
High EPSS 0.57% |
< 4.86.2 | 4.86.2 |
| GO-2026-4335 Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment |
Critical EPSS 0.25% |
>= 4.75.0, < 4.75.2 | 4.75.2 |
| GO-2026-4335 Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment |
Critical EPSS 0.25% |
>= 4.76.0, < 4.76.2 | 4.76.2 |
| GO-2026-4335 Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment |
Critical EPSS 0.25% |
>= 4.78.0, < 4.78.3 | 4.78.3 |
| GO-2026-4335 Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment |
Critical EPSS 0.25% |
>= 4.77.0, < 4.77.1 | 4.77.1 |
| GO-2026-4335 Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment |
Critical EPSS 0.25% |
< 4.43.5-0.20260112202845-e225ef57912c | 4.43.5-0.20260112202845-e225ef57912c |
| GHSA-4r5r-ccr6-q6f6 Fleet has an Access Control vulnerability in debug/pprof endpoints |
High EPSS 0.29% |
>= 4.78.0, < 4.78.3 | 4.78.3 |
| GHSA-4r5r-ccr6-q6f6 Fleet has an Access Control vulnerability in debug/pprof endpoints |
High EPSS 0.29% |
>= 4.77.0, < 4.77.1 | 4.77.1 |
| GHSA-4r5r-ccr6-q6f6 Fleet has an Access Control vulnerability in debug/pprof endpoints |
High EPSS 0.29% |
>= 4.76.0, < 4.76.2 | 4.76.2 |
| GHSA-4r5r-ccr6-q6f6 Fleet has an Access Control vulnerability in debug/pprof endpoints |
High EPSS 0.29% |
>= 4.75.0, < 4.75.2 | 4.75.2 |
| GHSA-gfpw-jgvr-cw4j Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability |
Medium EPSS 0.25% |
>= 4.75.0, < 4.75.2 | 4.75.2 |
| GHSA-gfpw-jgvr-cw4j Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability |
Medium EPSS 0.25% |
>= 4.76.0, < 4.76.2 | 4.76.2 |
| GHSA-gfpw-jgvr-cw4j Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability |
Medium EPSS 0.25% |
>= 4.77.0, < 4.77.1 | 4.77.1 |
| GHSA-gfpw-jgvr-cw4j Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability |
Medium EPSS 0.25% |
>= 4.78.0, < 4.78.2 | 4.78.2 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor