PT-2026-28387 · Fleet · Fleet

Secfox-Ai · Published 2026-03-27 · Updated 2026-04-07 · CVE-2026-29180

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.81.1

Description Fleet is open source device management software. A broken access control vulnerability exists in the host transfer API. A team maintainer can transfer hosts from any team into their own team, bypassing team isolation boundaries. Once transferred, the attacker gains full control over the stolen hosts, including the ability to execute scripts with root privileges. The host transfer endpoints verify write permission to the destination team but do not check permission over the source team. A bulk transfer variant allows stealing all matching hosts fleet-wide in a single request. Exploitation requires authentication as a team maintainer or team admin.

Recommendations Versions prior to 4.81.1 should be upgraded. Organizations concerned about exploitation should audit host transfer activity in Fleet logs for any unexpected team reassignments.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-29180

GHSA-M2H6-4XPQ-QW3M

GO-2026-4892

SUSE-SU-2026:1205-1

Affected Products

Fleet

References · 46

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29180.json · Exploit
• https://github.com/fleetdm/fleet/security/advisories/GHSA-m2h6-4xpq-qw3m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29180 · Security Note
• https://osv.dev/vulnerability/CVE-2026-29180 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m2h6-4xpq-qw3m · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1205-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4892 · Vendor Advisory
• https://github.com/fleetdm/fleet · Note
• https://github.com/fleetdm/fleet/releases/tag/fleet-v4.81.1 · Note
• https://suse.com/security/cve/CVE-2026-33990 · Note
• https://suse.com/security/cve/CVE-2026-32695 · Note
• https://suse.com/security/cve/CVE-2026-34040 · Note
• https://suse.com/security/cve/CVE-2026-33997 · Note
• https://suse.com/security/cve/CVE-2026-34204 · Note
• https://suse.com/security/cve/CVE-2026-33433 · Note