Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A SQL injection vulnerability in Fleet's Okta conditional access integration could allow an attacker who controls a single enrolled host to read or modify arbitrary data in the Fleet database, including stored session tokens. Disclosed session tokens may be replayed to act as a global administrator, which on a managed fleet leads to remote code execution on enrolled hosts. Impact When Fleet Premium with Okta conditional access is configured, an unauthenticated request path that supports the conditional access integration uses a host-supplied value in a database query without proper parameterization. Because the value is reported by the host's own agent and stored verbatim, any party that controls one enrolled host (the lowest-privilege role in the product) can influence the query. Successful exploitation could allow: - Disclosure of arbitrary database contents, including credentials and session tokens. - Replay of disclosed session tokens to gain global administrator access.…
Recommended action: Upgrade to 4.86.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
4.43.5-0.20260112202845-e225ef57912c4.75.24.78.34.77.14.76.2· Vendor fix available
Issue
A vulnerability in Fleet’s Windows MDM enrollment flow could allow an attacker to submit forged authentication tokens that are not properly validated. Because JWT signatures were not verified, Fleet could accept attacker-controlled identity claims, enabling enrollment of unauthorized devices under arbitrary Azure AD user identities. Impact If Windows MDM is enabled, an attacker can enroll rogue devices by submitting a forged JWT containing arbitrary identity claims. Due to missing JWT signature verification, Fleet accepts these claims without validating that the token was issued by Azure AD, allowing enrollment under any Azure AD user identity. Patches - 4.78.3 - 4.77.1 - 4.76.2 - 4.75.2 - 4.53.3 Workarounds If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM. For more information If you have any questions or comments about this advisory: Email us at security@fleetdm.com Join #fleet in osquery Slack Credits We thank @secfox-ai…
Recommended action: Upgrade to 4.78.3, 4.77.1, 4.76.2 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A broken access control issue in Fleet allowed authenticated users to access debug and profiling endpoints regardless of role. As a result, low-privilege users could view internal server diagnostics and trigger resource-intensive profiling operations. Impact Fleet’s debug/pprof endpoints are accessible to any authenticated user regardless of role, including the lowest-privilege “Observer” role. This allows low-privilege users to access sensitive server internals, including runtime profiling data and in-memory application state, and to trigger CPU-intensive profiling operations that could lead to denial of service. Patches - 4.78.3 - 4.77.1 - 4.76.2 - 4.75.2 - 4.53.3 Workarounds If an immediate upgrade is not possible, users should put the debug/pprof endpoints behind an IP allowlist. For more information If you have any questions or comments about this advisory: Email us at security@fleetdm.com Join #fleet in osquery Slack Credits We thank @secfox-ai for responsibly reporting…
Recommended action: Upgrade to 4.78.3, 4.77.1, 4.76.2 or 4.75.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A cross-site scripting (XSS) vulnerability in Fleet’s Windows MDM authentication flow could allow an attacker to compromise a Fleet user account. In certain cases, this could lead to administrative access and the ability to perform privileged actions on managed devices. Impact If Windows MDM is enabled, an attacker could exploit a cross-site scripting (XSS) vulnerability by convincing an authenticated Fleet user to visit a malicious link. Successful exploitation could allow retrieval of the user’s Fleet authentication token from their browser. A compromised authentication token may grant administrative access to the Fleet API, allowing an attacker to perform privileged actions such as deploying scripts to managed hosts. This issue does not allow unauthenticated access and does not affect instances where Windows MDM is disabled. Patches - 4.78.2 - 4.77.1 - 4.76.2 - 4.75.2 - 4.53.3 Workarounds If an immediate upgrade is not possible, affected Fleet users should temporarily…
Recommended action: Upgrade to 4.78.2, 4.77.1, 4.76.2 or 4.75.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.