Loading...
Skip to main content
GeekWala

CVE-2026-34386 — Fleet vulnerable to SQL Injection in...

MEDIUM

Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin

Published March 30, 2026Updated April 2, 2026Source: osv

Summary

### Summary A SQL Injection vulnerability in Fleet's MDM bootstrap package configuration allows an authenticated user with Team Admin or Global Admin privileges to modify arbitrary team configurations, exfiltrate sensitive data from the Fleet database, and inject arbitrary content into team configs via direct API calls. ### Impact An authenticated user with Team Admin or Global Admin role can exploit a flaw in how user-supplied input is handled during MDM bootstrap package configuration. Insufficient server-side input validation allows crafted input to manipulate database queries in unintended ways. Successful exploitation could enable cross-team data corruption, exfiltration of sensitive information such as password hashes and API tokens, and potential privilege escalation. Exploitation requires authentication with team or global admin privileges and MDM to be enabled. This issue does not affect instances where Apple MDM is disabled. ### Workarounds If an immediate upgrade is not possible, affected Fleet users should temporarily disable Apple MDM or limit admin roles. ### For more information If there are any questions or comments about this advisory: Send an email to [security@fleetdm.com](mailto:security@fleetdm.com) Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw) ### Credits Fleet thanks the Secfox Research Team (@secfox-ai) for responsibly reporting this issue.

Advisory Timeline

  • First published March 30, 2026 (196 days ago).
  • Last revised April 2, 2026 — 3 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Go
Update github.com/fleetdm/fleet/v4 to 4.81.0 or later
go get github.com/fleetdm/fleet/v4@v4.81.0

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: go (1).

PackageEcosystemAffectedFixed In
github.com/fleetdm/fleet/v4
go
All versions4.81.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
—
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

References

Frequently Asked Questions

What is CVE-2026-34386?
Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 8.8/10).
How do I check if my project is affected by CVE-2026-34386?
CVE-2026-34386 affects github.com/fleetdm/fleet/v4. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-34386 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
8.8

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-9p23-p2m4-2r4m
GO-2026-4913

Related CVEs

More Go Modules advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies