PT-2026-28630 · Fleet · Fleet

Fuzzztf · Published 2026-03-27 · Updated 2026-04-07 · CVE-2026-34389

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.81.0

Description Fleet, an open source device management software, had a flaw in how user invitations were handled. Specifically, the email address entered when accepting an invitation wasn’t checked against the email address linked to the original invitation. This allowed an attacker with a valid invite token to create an account using any email address and gain the role assigned to the invitation, potentially including global administrator privileges.

Recommendations Update to version 4.81.0 or later.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-34389

GHSA-4F9R-X588-PP2H

GO-2026-4912

SUSE-SU-2026:1205-1

Affected Products

Fleet

References · 45

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34389.json · Exploit
• https://github.com/fleetdm/fleet/security/advisories/GHSA-4f9r-x588-pp2h · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4912 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34389 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1205-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34389 · Security Note
• https://osv.dev/vulnerability/GHSA-4f9r-x588-pp2h · Vendor Advisory
• https://github.com/fleetdm/fleet · Note
• https://suse.com/support/update/announcement/2026/suse-su-20261205-1 · Note
• https://suse.com/security/cve/CVE-2026-27018 · Note
• https://suse.com/security/cve/CVE-2026-34389 · Note
• https://suse.com/security/cve/CVE-2026-34388 · Note
• https://suse.com/security/cve/CVE-2026-32241 · Note
• https://suse.com/security/cve/CVE-2026-33634 · Note
• https://suse.com/security/cve/CVE-2026-34040 · Note