CVE-2026-34385

highpriority · track · 32EPSS 0.002 · 10 %ileDEEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.21% (10th) EPSS

CVSS 8.1 · high

Is it mine?

5 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · osv · cert_bund

EPSS · scored 2026-10-27

Fleet is open source device management software. Prior to 4.81.0, a second-order SQL injection vulnerability in Fleet's Apple MDM profile delivery pipeline could allow an attacker with a valid MDM enrollment certificate to exfiltrate or modify the contents of the Fleet database, including user credentials, API tokens, and device enrollment secrets. Version 4.81.0 patches the issue.

cvss

Technical severity, 0–10. One row per scoring source.

8.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.2–8.1

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 5.2

v4.06.2mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:Usecondary · ENISA EU

v4.06.2mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · security-advisories@github.com

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-89USCWE-89US

affected products (5)

Products and version ranges known to be affected.

Open Source Fleet <4.81.1all versionscert_bundDE
Open Source Fleet< 4.81.1cert_bundDE
fleetdm Fleet≤ < 4.81.0enisa_euvdEU
fleetdm fleet< 4.81.0nvdUScpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*
Go github.com/fleetdm/fleet/v4< 4.81.0osvUSpkg:golang/github.com/fleetdm/fleet/v4

advisories (3)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-0902Fleet: Mehrere SchwachstellenDeutsch2026-03-29csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Fleet ausnutzen, um einen SQL-Injection Angriff durchzuführen, um einen Denial of Service Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, und um beliebigen Programmcode mit Administratorrechten auszuführen.
GHSA-v895-833r-8c45Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the database2026-03-30ghsa · osvUS
### Summary A critical second-order SQL Injection vulnerability in Fleet's Apple MDM profile delivery pipeline could allow an attacker with a valid MDM enrollment certificate to exfiltrate or modify the contents of the Fleet database, including user credentials, API tokens, and device enrollment secrets. ### Impact If Apple MDM is enabled, an attacker controlling an enrolled device can send a malicious UDID during the MDM Authenticate check-in. The UDID is stored safely via parameterized queries, but is later interpolated directly into SQL when the async worker processes the job. This enables blind, boolean-based, and UNION-based SQL injection across four simultaneous subqueries. Because Fleet's database driver is configured with `multiStatements=true`, the attacker can also execute stacked queries, enabling arbitrary writes to the database. This includes inserting new admin accounts, modifying configuration, deploying malicious profiles or scripts to managed devices, and deleting data. Exploitation requires a valid SCEP-issued enrollment certificate (mTLS), but any enrolled device, including attacker-controlled devices, can exploit this vulnerability. This issue does not affect instances where Apple MDM is disabled. ### Workarounds If an immediate upgrade is not possible, affected Fleet users should temporarily disable Apple MDM. ### For more information If there are any questions or comments about this advisory: Send an email to [security@fleetdm.com](mailto:security@fleetdm.com) Join #fleet in [[osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw) ### Credits Fleet thanks@secfox-ai for responsibly reporting this issue.
GO-2026-4914Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the database in github.com/fleetdm/fleet2026-04-02vendor · osvUS
Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the database in github.com/fleetdm/fleet

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd osv cert_bund nvd NVD CVE.org MITRE

published 2026-03-27modified 2026-10-26

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan