PT-2026-28630 · Fleet · Fleet

Fuzzztf · Publicado 2026-03-27 · Atualizado 2026-04-07 · CVE-2026-34389

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.81.0

Description Fleet, an open source device management software, had a flaw in how user invitations were handled. Specifically, the email address entered when accepting an invitation wasn’t checked against the email address linked to the original invitation. This allowed an attacker with a valid invite token to create an account using any email address and gain the role assigned to the invitation, potentially including global administrator privileges.

Recommendations Update to version 4.81.0 or later.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2026-34389

GHSA-4F9R-X588-PP2H

GO-2026-4912

SUSE-SU-2026:1205-1

Produtos afetados

Fleet

Referências · 45

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34389.json · Exploit
• https://github.com/fleetdm/fleet · Nota
• https://github.com/fleetdm/fleet/security/advisories/GHSA-4f9r-x588-pp2h · Aviso do Fabricante
• https://suse.com/support/update/announcement/2026/suse-su-20261205-1 · Nota
• https://suse.com/security/cve/CVE-2026-27018 · Nota
• https://suse.com/security/cve/CVE-2026-34389 · Nota
• https://suse.com/security/cve/CVE-2026-34388 · Nota
• https://osv.dev/vulnerability/GO-2026-4912 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-32241 · Nota
• https://suse.com/security/cve/CVE-2026-33634 · Nota
• https://suse.com/security/cve/CVE-2026-34040 · Nota
• https://suse.com/security/cve/CVE-2026-33747 · Nota
• https://twitter.com/CVEnew/status/2037719426360082476 · Publicação no Twitter
• https://suse.com/security/cve/CVE-2026-33186 · Nota
• https://suse.com/security/cve/CVE-2026-26233 · Nota