SQL Injection Vulnerability in Fleet Device Management Software
CVE-2026-34386

6.3MEDIUM

Key Information:

Vendor

Fleetdm

Status
Fleet
Vendor
CVE Published:
27 March 2026

What is CVE-2026-34386?

Fleet, an open source device management software, has a SQL injection vulnerability in its MDM bootstrap package configuration. Authenticated users with Team Admin or Global Admin privileges can exploit this flaw to alter team configurations, extract sensitive data from the Fleet database, and inject unauthorized content directly via API calls. The vulnerability has been resolved in version 4.81.0, reinforcing the importance of keeping software up to date to mitigate potential security threats.

Affected Version(s)

fleet < 4.81.0

References

https://github.com/fleetdm/fleet/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.