PT-2026-28627 · Fleet · Fleet

Prateek-0490 · Publicado 2026-03-27 · Atualizado 2026-04-07 · CVE-2026-34386

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.81.0

Description Fleet is open source device management software susceptible to a SQL injection issue in its MDM bootstrap package configuration. An authenticated user possessing Team Admin or Global Admin privileges can modify team configurations, extract sensitive data from the Fleet database, and inject content into team configurations through direct API calls. The vulnerable API calls are related to the MDM bootstrap package configuration. The vulnerability allows modification of arbitrary team configurations via direct API calls.

Recommendations Update to version 4.81.0 or later.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-34386

GHSA-9P23-P2M4-2R4M

GO-2026-4913

SUSE-SU-2026:1205-1

Produtos afetados

Fleet

Referências · 46

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34386.json · Exploit
• https://github.com/fleetdm/fleet · Nota
• https://github.com/fleetdm/fleet/security/advisories/GHSA-9p23-p2m4-2r4m · Aviso do Fabricante
• https://twitter.com/cyberbivash/status/2037606784131547582 · Publicação no Twitter
• https://suse.com/support/update/announcement/2026/suse-su-20261205-1 · Nota
• https://suse.com/security/cve/CVE-2026-27018 · Nota
• https://suse.com/security/cve/CVE-2026-34389 · Nota
• https://suse.com/security/cve/CVE-2026-34388 · Nota
• https://suse.com/security/cve/CVE-2026-32241 · Nota
• https://suse.com/security/cve/CVE-2026-33634 · Nota
• https://suse.com/security/cve/CVE-2026-34040 · Nota
• https://suse.com/security/cve/CVE-2026-33747 · Nota
• https://twitter.com/CVEnew/status/2037719431829422483 · Publicação no Twitter
• https://suse.com/security/cve/CVE-2026-33186 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-34386 · Nota de Segurança