DeutschShown in its original language — a full translation is planned for a future version.
Fleet: Mehrere Schwachstellen
view advisory published 2026-03-29
Ein Angreifer kann mehrere Schwachstellen in Fleet ausnutzen, um einen SQL-Injection Angriff durchzuführen, um einen Denial of Service Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, und um beliebigen Programmcode mit Administratorrechten auszuführen.
01
describes (10)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-34391US | high7.5 | — | ||
Fleet is open source device management software. Prior to 4.81.1, a vulnerability in Fleet's Windows MDM command processing allows a malicious enrolled device to access MDM command… | ||||
| CVE-2026-34389US | medium6.5 | — | ||
Fleet is open source device management software. Prior to 4.81.0, Fleet contained an issue in the user invitation flow where the email address provided during invite acceptance was… | ||||
| CVE-2026-34388US | high7.5 | — | ||
Fleet is open source device management software. Prior to 4.81.0, a denial-of-service vulnerability in Fleet's gRPC Launcher endpoint allows an authenticated host to crash the enti… | ||||
| CVE-2026-34387US | critical9.8 | — | ||
Fleet is open source device management software. Prior to 4.81.1, a command injection vulnerability in Fleet's software installer pipeline allows an attacker to achieve arbitrary c… | ||||
| CVE-2026-34386US | high8.8 | — | ||
Fleet is open source device management software. Prior to 4.81.0, a SQL injection vulnerability in Fleet's MDM bootstrap package configuration allows an authenticated user with Tea… | ||||
| CVE-2026-34385US | high8.1 | — | ||
Fleet is open source device management software. Prior to 4.81.0, a second-order SQL injection vulnerability in Fleet's Apple MDM profile delivery pipeline could allow an attacker… | ||||
| CVE-2026-29180US | high8.8OT elevated | — | ||
Fleet is open source device management software. Prior to 4.81.1, a broken access control vulnerability in Fleet's host transfer API allows a team maintainer to transfer hosts from… | ||||
| CVE-2026-26061US | high7.5 | — | ||
Fleet is open source device management software. Prior to 4.81.0, Fleet contained multiple unauthenticated HTTP endpoints that read request bodies without enforcing a size limit. A… | ||||
| CVE-2026-26060US | high8.8 | — | ||
Fleet is open source device management software. Prior to 4.81.0, a vulnerability in Fleet’s password management logic could allow previously issued password reset tokens to remain… | ||||
| CVE-2026-26186US | high8.8 | — | ||
Fleet is open source device management software. A SQL injection vulnerability in versions prior to 4.80.1 allowed authenticated users to inject arbitrary SQL expressions via the `… | ||||
02
references
External citations — patches, advisories, analysis.
- Fleet Security Advisories vom 2026-03-29external
- GitHub Security Advisory GHSA-3458-r943-hmx4 vom 2026-03-29external
- GitHub Security Advisory GHSA-4f9r-x588-pp2h vom 2026-03-29external
- GitHub Security Advisory GHSA-7rhw-5mpv-gp4h vom 2026-03-29external
- GitHub Security Advisory GHSA-99hj-44vg-hfcp vom 2026-03-29external
- GitHub Security Advisory GHSA-9p23-p2m4-2r4m vom 2026-03-29external
- GitHub Security Advisory GHSA-m2h6-4xpq-qw3m vom 2026-03-29external
- GitHub Security Advisory GHSA-v895-833r-8c45 vom 2026-03-29external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan