github.com/fleetdm/fleet/v4 (Go)
Advisories
64
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 4.89.0 or later clears every advisory below that has a fix.
Upgrade commands
go
go get github.com/fleetdm/fleet/v4@v4.89.0 && go mod tidyKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-rxhg-vcww-2mpw Fleet: ORDER BY column injection on activity list endpoints |
Low EPSS 0.17% |
< 4.89.0 | 4.89.0 |
| GHSA-rxhg-vcww-2mpw Fleet: ORDER BY column injection on activity list endpoints |
Low EPSS 0.17% |
< 4.89.0 | 4.89.0 |
| GHSA-q9c5-pp7m-fm2g Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs |
Medium EPSS 0.24% |
< 4.87.0 | 4.87.0 |
| GHSA-q9c5-pp7m-fm2g Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs |
Medium EPSS 0.24% |
< 4.87.0 | 4.87.0 |
| GO-2026-6264 Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database |
High EPSS 0.57% |
< 4.86.2 | 4.86.2 |
| GHSA-88p2-jj8w-j8qg Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint |
Medium EPSS 0.44% |
< 4.87.0 | 4.87.0 |
| GHSA-88p2-jj8w-j8qg Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint |
Medium EPSS 0.44% |
< 4.87.0 | 4.87.0 |
| GHSA-gm7f-v959-fr2g Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint |
Medium EPSS 0.30% |
< 4.85.0 | 4.85.0 |
| GHSA-gm7f-v959-fr2g Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint |
Medium EPSS 0.30% |
< 4.85.0 | 4.85.0 |
| GHSA-x4qr-qw6h-wvxq Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint |
Medium EPSS 0.37% |
< 4.84.2 | 4.84.2 |
| GHSA-x4qr-qw6h-wvxq Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint |
Medium EPSS 0.37% |
< 4.84.2 | 4.84.2 |
| GHSA-vxm7-9x8v-8gm4 Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint |
Medium EPSS 0.37% |
< 4.84.2 | 4.84.2 |
| GHSA-vxm7-9x8v-8gm4 Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint |
Medium EPSS 0.37% |
< 4.84.2 | 4.84.2 |
| GHSA-mxmp-wr3w-rvqx Fleet: IP spoofing allows bypassing API rate limiting |
High EPSS 0.28% |
< 4.80.1 | 4.80.1 |
| GHSA-mxmp-wr3w-rvqx Fleet: IP spoofing allows bypassing API rate limiting |
High EPSS 0.28% |
< 4.80.1 | 4.80.1 |
| GHSA-9vcr-g537-3w5v Fleet vulnerable to OS command injection in software packages |
Critical EPSS 0.77% |
< 4.81.1 | 4.81.1 |
| GHSA-9vcr-g537-3w5v Fleet vulnerable to OS command injection in software packages |
Critical EPSS 0.77% |
< 4.81.1 | 4.81.1 |
| GHSA-x67p-9m2r-fxqv Fleet server may terminate unexpectedly when handling certain gRPC requests |
Medium EPSS 0.37% |
< 4.81.0 | 4.81.0 |
| GHSA-x67p-9m2r-fxqv Fleet server may terminate unexpectedly when handling certain gRPC requests |
Medium EPSS 0.37% |
< 4.81.0 | 4.81.0 |
| GHSA-ffg9-j72f-j6xm Fleet Windows MDM Azure AD JWT Authentication Bypass |
High EPSS 0.38% |
< 4.82.0 | 4.82.0 |
| GHSA-ffg9-j72f-j6xm Fleet Windows MDM Azure AD JWT Authentication Bypass |
High EPSS 0.38% |
< 4.82.0 | 4.82.0 |
| GHSA-j8h8-75h3-jg53 Fleet has a rate limiting bypass via untrusted client IP headers |
Medium EPSS 0.43% |
< 4.80.1 | 4.80.1 |
| GHSA-j8h8-75h3-jg53 Fleet has a rate limiting bypass via untrusted client IP headers |
Medium EPSS 0.43% |
< 4.80.1 | 4.80.1 |
| GHSA-2rc4-7jc6-qffh Fleet has a Windows MDM management endpoint authentication bypass |
High EPSS 0.21% |
< 4.81.0 | 4.81.0 |
| GHSA-2rc4-7jc6-qffh Fleet has a Windows MDM management endpoint authentication bypass |
High EPSS 0.21% |
< 4.81.0 | 4.81.0 |
| GHSA-rphv-h674-5hp2 Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit |
High EPSS 0.11% |
< 4.81.1 | 4.81.1 |
| GHSA-rphv-h674-5hp2 Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit |
High EPSS 0.11% |
< 4.81.1 | 4.81.1 |
| GHSA-4f9r-x588-pp2h Fleet's user account creation via invite does not enforce invited email address |
Medium EPSS 0.19% |
< 4.81.0 | 4.81.0 |
| GHSA-4f9r-x588-pp2h Fleet's user account creation via invite does not enforce invited email address |
Medium EPSS 0.19% |
< 4.81.0 | 4.81.0 |
| GHSA-w254-4hp5-7cvv Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint |
High EPSS 0.27% |
< 4.81.0 | 4.81.0 |
| GHSA-w254-4hp5-7cvv Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint |
High EPSS 0.27% |
< 4.81.0 | 4.81.0 |
| GHSA-9p23-p2m4-2r4m Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin |
High EPSS 0.33% |
< 4.81.0 | 4.81.0 |
| GHSA-9p23-p2m4-2r4m Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin |
High EPSS 0.33% |
< 4.81.0 | 4.81.0 |
| GHSA-v895-833r-8c45 Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the database |
High EPSS 0.21% |
< 4.81.0 | 4.81.0 |
| GHSA-v895-833r-8c45 Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the database |
High EPSS 0.21% |
< 4.81.0 | 4.81.0 |
| GHSA-m2h6-4xpq-qw3m A Fleet team maintainer can transfer hosts from any team via missing source team authorization |
High EPSS 0.33% |
< 4.81.1 | 4.81.1 |
| GHSA-m2h6-4xpq-qw3m A Fleet team maintainer can transfer hosts from any team via missing source team authorization |
High EPSS 0.33% |
< 4.81.1 | 4.81.1 |
| GHSA-99hj-44vg-hfcp Fleet's unbounded request body read allows remote Denial of Service |
High EPSS 0.45% |
< 4.43.5-0.20260113202849-bbc1aef2987d | 4.43.5-0.20260113202849-bbc1aef2987d |
| GHSA-99hj-44vg-hfcp Fleet's unbounded request body read allows remote Denial of Service |
High EPSS 0.45% |
all versions | No fix yet |
| GHSA-3458-r943-hmx4 Fleet: Password reset tokens remain valid after password change for 24 hours |
High EPSS 0.35% |
< 4.43.5-0.20260113202849-bbc1aef2987d | 4.43.5-0.20260113202849-bbc1aef2987d |
| GHSA-3458-r943-hmx4 Fleet: Password reset tokens remain valid after password change for 24 hours |
High EPSS 0.35% |
all versions | No fix yet |
| GHSA-2v6m-6xw3-6467 Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users |
Medium EPSS 0.27% |
< 4.80.1 | 4.80.1 |
| GHSA-2v6m-6xw3-6467 Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users |
Medium EPSS 0.27% |
< 4.80.1 | 4.80.1 |
| GHSA-5jvp-m9h4-253h Fleet: Authorization Bypass in certificate template batch deletion for team administrators |
Medium EPSS 0.21% |
< 4.80.1 | 4.80.1 |
| GHSA-5jvp-m9h4-253h Fleet: Authorization Bypass in certificate template batch deletion for team administrators |
Medium EPSS 0.21% |
< 4.80.1 | 4.80.1 |
| GHSA-9pm7-6g36-6j78 Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint |
Medium EPSS 0.30% |
< 4.80.1 | 4.80.1 |
| GHSA-9pm7-6g36-6j78 Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint |
Medium EPSS 0.30% |
< 4.80.1 | 4.80.1 |
| GHSA-ppwx-5jq7-px2w Fleet: Device lock PIN can be predicted if lock time is known |
Medium EPSS 0.14% |
< 4.80.1 | 4.80.1 |
| GHSA-ppwx-5jq7-px2w Fleet: Device lock PIN can be predicted if lock time is known |
Medium EPSS 0.14% |
< 4.80.1 | 4.80.1 |
| GHSA-49xw-vfc4-7p43 Fleet has an SQL Injection vulnerability via backtick escape in ORDER BY parameter |
High EPSS 0.35% |
< 4.80.1 | 4.80.1 |
| GHSA-49xw-vfc4-7p43 Fleet has an SQL Injection vulnerability via backtick escape in ORDER BY parameter |
High EPSS 0.35% |
< 4.80.1 | 4.80.1 |
| GO-2026-4335 Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment |
Critical EPSS 0.25% |
>= 4.75.0, < 4.75.2>= 4.76.0, < 4.76.2>= 4.77.0, < 4.77.1>= 4.78.0, < 4.78.3 | 4.75.24.76.24.77.14.78.3 |
| GHSA-4r5r-ccr6-q6f6 Fleet has an Access Control vulnerability in debug/pprof endpoints |
High EPSS 0.29% |
>= 4.75.0, < 4.75.2>= 4.76.0, < 4.76.2>= 4.77.0, < 4.77.1>= 4.78.0, < 4.78.3 | 4.75.24.76.24.77.14.78.3 |
| GHSA-4r5r-ccr6-q6f6 Fleet has an Access Control vulnerability in debug/pprof endpoints |
High EPSS 0.29% |
< 4.78.3-0.20260112221730-5c030e32a3a9 | 4.78.3-0.20260112221730-5c030e32a3a9 |
| GHSA-gfpw-jgvr-cw4j Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability |
Medium EPSS 0.25% |
>= 4.75.0, < 4.75.2>= 4.76.0, < 4.76.2>= 4.77.0, < 4.77.1>= 4.78.0, < 4.78.2 | 4.75.24.76.24.77.14.78.2 |
| GHSA-gfpw-jgvr-cw4j Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability |
Medium EPSS 0.25% |
< 4.43.5-0.20260111020427-0e6c790803d1 | 4.43.5-0.20260111020427-0e6c790803d1 |
| GHSA-52jx-g6m5-h735 Fleet has SAML authentication vulnerability due to improper SAML response validation |
Critical EPSS 0.67% |
< 4.53.2 | 4.53.2 |
| GHSA-52jx-g6m5-h735 Fleet has SAML authentication vulnerability due to improper SAML response validation |
Critical EPSS 0.67% |
>= 4.54.0, < 4.58.1 | 4.58.1 |
| GHSA-52jx-g6m5-h735 Fleet has SAML authentication vulnerability due to improper SAML response validation |
Critical EPSS 0.67% |
>= 4.62.0, < 4.62.4 | 4.62.4 |
| GHSA-52jx-g6m5-h735 Fleet has SAML authentication vulnerability due to improper SAML response validation |
Critical EPSS 0.67% |
>= 4.63.0, < 4.63.2 | 4.63.2 |
| GHSA-52jx-g6m5-h735 Fleet has SAML authentication vulnerability due to improper SAML response validation |
Critical EPSS 0.67% |
>= 4.64.0, < 4.64.2 | 4.64.2 |
| GHSA-52jx-g6m5-h735 Fleet has SAML authentication vulnerability due to improper SAML response validation |
Critical EPSS 0.67% |
all versions | No fix yet |
| GHSA-w3wf-cfx3-6gcx SAML authentication vulnerability due to stdlib XML parsing |
High EPSS 2.20% |
< 3.5.1 | 3.5.1 |
| GHSA-ch68-7cf4-35vr Limited ability to spoof SAML authentication with missing audience verification in Fleet |
Medium EPSS 0.89% |
< 4.9.1 | 4.9.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor