Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Fleet — Vulnerabilities & Security Advisories 44

All 44 CVE vulnerabilities found in Fleet, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security weaknesses affecting the Fleet product line, specifically focusing on configuration flaws and access control issues tagged as critical. The collection encompasses publicly disclosed vulnerabilities reported between 2021 and the present, drawing data from vendor advisories and third-party research feeds. Users can utilize this resource to track the latest security advisories issued by the vendor, understand the prevalence and impact of specific weakness classes within fleet management systems, or review the historical vulnerability record for this product family. The data presented here is intended to assist security professionals in conducting risk assessments, prioritizing remediation efforts, and maintaining an up-to-date inventory of threats targeting fleet infrastructure. By centralizing these findings, the page offers a comprehensive view of the security posture without requiring users to navigate multiple disparate sources. All entries are organized chronologically and categorized by severity to facilitate efficient analysis and decision-making regarding system hardening and patch deployment strategies.

Vendor: Fleet

CVE ID Title CVSS Severity Published
CVE-2026-111924 Fleet before 4.83.0 Denial of Service via Unbounded Gzip Decompression CWE-409 7.5 High 2026-10-17
CVE-2026-111923 Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing CWE-674 7.5 High 2026-10-17
CVE-2025-23390 Fleet doesn’t validate a server’s certificate when connecting through SSH CWE-295 6.3 Medium 2026-10-15
CVE-2026-103265 Fleet before 4.89.0 Information Disclosure via MDM Command Results CWE-863 4.3 Medium 2026-10-01
CVE-2026-103264 Fleet before 4.87.0 Authentication Bypass via Device Identifiers CWE-287 9.1 Critical 2026-10-01
CVE-2026-101047 Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs CWE-862 5.3 Medium 2026-09-27
CVE-2026-101046 Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints CWE-89 3.1 Low 2026-09-27
CVE-2026-101045 Fleet Homebrew Cask OS Command Injection via Metadata CWE-78 8.0 High 2026-09-27
CVE-2026-75036 Fleet: DNS exfiltration via Sprig getHostByName in fleet.yaml Helm template preprocessing CWE-918 5.3 Medium 2026-09-03
CVE-2026-54245 Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database CWE-89 7.6 High 2026-08-26
CVE-2026-46371 Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint CWE-89 6.5 Medium 2026-08-26
CVE-2026-46370 Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint CWE-89 6.5 Medium 2026-08-26
CVE-2026-41262 Fleet: Cross-Team Policy Data Exposure via Global Policy Read Endpoint CWE-863 4.3 Medium 2026-08-26
CVE-2026-48786 Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint CWE-200 6.5 Medium 2026-08-26
CVE-2026-46356 Fleet: IP spoofing allows bypassing API rate limiting CWE-290 - - 2026-05-14
CVE-2026-26191 Fleet vulnerable to OS command injection in software packages CWE-78 - - 2026-05-14
CVE-2026-26062 Fleet server may terminate unexpectedly when handling certain gRPC requests CWE-20 - - 2026-05-14
CVE-2026-24899 Fleet Windows MDM Azure AD JWT Authentication Bypass CWE-290 - - 2026-05-14
CVE-2026-24000 Fleet has a rate limiting bypass via untrusted client IP headers CWE-290 - - 2026-05-14
CVE-2026-23998 Fleet has a Windows MDM management endpoint authentication bypass CWE-295 - - 2026-05-14
CVE-2026-27806 Fleet Affected by Local Privilege Escalation via Tcl Command Injection in Orbit CWE-78 7.8 High 2026-04-08
CVE-2026-34391 Fleet Vulnerable to Windows MDM cross-device command disclosure CWE-488 6.5 - 2026-03-27
CVE-2026-34389 Fleet's user account creation via invite does not enforce invited email address CWE-287 8.8 - 2026-03-27
CVE-2026-34388 Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint CWE-703 6.5 - 2026-03-27
CVE-2026-34387 Fleet vulnerable to OS command injection via crafted software package metadata in uninstall scripts CWE-78 7.2 - 2026-03-27
CVE-2026-34386 Fleet vulnerable to SQL injection in MDM bootstrap package by authenticated team or global admin CWE-89 6.5 - 2026-03-27
CVE-2026-34385 Fleet's Apple MDM profile delivery has second-order SQL injection that can compromise the database CWE-89 8.8 - 2026-03-27
CVE-2026-29180 Fleet's team maintainer can transfer hosts from any team via missing source team authorization CWE-862 9.1 - 2026-03-27
CVE-2026-26061 Fleet's unbounded request body read allows remote Denial of Service CWE-770 7.5 - 2026-03-27
CVE-2026-26060 Fleet: Password reset tokens remain valid after password change for 24 hours CWE-613 7.5 - 2026-03-27

All 44 known CVE vulnerabilities affecting Fleet with full Chinese analysis, references, and POCs where available.