PT-2026-22117 · Fleet · Fleet

Secfox-Ai · Published 2026-02-26 · Updated 2026-03-25 · CVE-2026-27465

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.80.1

Description Fleet’s configuration API could expose Google Calendar service account credentials to authenticated users with low-privilege roles. This may allow unauthorized access to Google Calendar resources associated with the service account. The software returns configuration data through an API endpoint, accessible to authenticated users, including those with the “Observer” role. In affected versions, Google Calendar service account credentials were not properly obfuscated before being returned, allowing a low-privilege user to retrieve the service account’s private key material. This could allow unauthorized access to calendar data or other Google Workspace resources associated with the service account. The issue does not allow escalation of privileges within Fleet or access to device management functionality. The vulnerable API endpoint exposes the credentials.

Recommendations Upgrade to version 4.80.1 or later. If an immediate upgrade is not possible, remove the Google Calendar integration from Fleet and rotate the affected Google service account credentials.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-201

CWE-200

Related Identifiers

CVE-2026-27465

GHSA-2V6M-6XW3-6467

GO-2026-4560

SUSE-SU-2026:1042-1

Affected Products

Fleet

References · 142

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27465.json · Exploit
• https://github.com/fleetdm/fleet/security/advisories/GHSA-2v6m-6xw3-6467 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4560 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27465 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2v6m-6xw3-6467 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27465 · Security Note
• https://github.com/fleetdm/fleet · Note
• https://github.com/fleetdm/fleet/commit/23fc6804efe785f806f769d6be1f5f05b2e13ec2 · Note
• https://suse.com/security/cve/CVE-2026-30933 · Note
• https://suse.com/security/cve/CVE-2026-28790 · Note
• https://suse.com/security/cve/CVE-2026-28268 · Note
• https://suse.com/security/cve/CVE-2026-27944 · Note
• https://suse.com/security/cve/CVE-2026-28683 · Note
• https://suse.com/security/cve/CVE-2026-27819 · Note