PT-2026-28629 · Fleet · Fleet

Fuzzztf · Published 2026-03-27 · Updated 2026-04-07 · CVE-2026-34388

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.81.0

Description Fleet, an open-source device management software, contains a flaw in its gRPC Launcher endpoint. An authenticated host can exploit this to cause a denial-of-service condition, leading to the termination of the entire Fleet server process. This disruption impacts all connected hosts, Mobile Device Management (MDM) enrollments, and API consumers by sending an unexpected log type value to the gRPC Launcher endpoint.

Recommendations Update to version 4.81.0 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-703

Related Identifiers

CVE-2026-34388

GHSA-W254-4HP5-7CVV

GO-2026-4915

SUSE-SU-2026:1205-1

Affected Products

Fleet

References · 45

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34388.json · Exploit
• https://github.com/fleetdm/fleet/security/advisories/GHSA-w254-4hp5-7cvv · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w254-4hp5-7cvv · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4915 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34388 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1205-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34388 · Vendor Advisory
• https://github.com/fleetdm/fleet · Note
• https://suse.com/security/cve/CVE-2026-33990 · Note
• https://suse.com/security/cve/CVE-2026-32695 · Note
• https://suse.com/security/cve/CVE-2026-34040 · Note
• https://suse.com/security/cve/CVE-2026-33997 · Note
• https://suse.com/security/cve/CVE-2026-34204 · Note
• https://suse.com/security/cve/CVE-2026-33433 · Note
• https://suse.com/security/cve/CVE-2026-34388 · Note