Denial-of-Service Vulnerability in Fleet Management Software by FleetDM

CVE-2026-26062

What is CVE-2026-26062?

Fleet, the open-source device management software, exhibits a vulnerability in the gRPC Launcher 'PublishLogs' endpoint prior to version 4.81.0. This DoS issue arises when certain unexpected input values are processed, potentially causing the Fleet server process to terminate upon receiving an authenticated request from a compromised Launcher host. An attacker with access to an enrolled Launcher node key can exploit this by sending a single gRPC request, effectively leading to an immediate denial of service. While this vulnerability solely impacts service availability, it can result in significant operational disruptions. Users are encouraged to upgrade to version 4.81.0 or implement mitigative measures, such as restricting network access to the gRPC endpoint and monitoring for abnormal process behavior.

References