PT-2026-28627 · Fleet · Fleet

Prateek-0490 · Published 2026-03-27 · Updated 2026-04-07 · CVE-2026-34386

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.81.0

Description Fleet is open source device management software susceptible to a SQL injection issue in its MDM bootstrap package configuration. An authenticated user possessing Team Admin or Global Admin privileges can modify team configurations, extract sensitive data from the Fleet database, and inject content into team configurations through direct API calls. The vulnerable API calls are related to the MDM bootstrap package configuration. The vulnerability allows modification of arbitrary team configurations via direct API calls.

Recommendations Update to version 4.81.0 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-34386

GHSA-9P23-P2M4-2R4M

GO-2026-4913

SUSE-SU-2026:1205-1

Affected Products

Fleet

References · 46

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34386.json · Exploit
• https://github.com/fleetdm/fleet/security/advisories/GHSA-9p23-p2m4-2r4m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34386 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1205-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9p23-p2m4-2r4m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34386 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4913 · Vendor Advisory
• https://github.com/fleetdm/fleet · Note
• https://suse.com/security/cve/CVE-2026-33990 · Note
• https://suse.com/security/cve/CVE-2026-32695 · Note
• https://suse.com/security/cve/CVE-2026-34040 · Note
• https://suse.com/security/cve/CVE-2026-33997 · Note
• https://twitter.com/cyberbivash/status/2037606784131547582 · Twitter Post
• https://suse.com/security/cve/CVE-2026-34204 · Note
• https://suse.com/security/cve/CVE-2026-33433 · Note