PT-2026-40971 · Fleet · Fleet

Secfox-Ai · Published 2026-05-14 · Updated 2026-06-25 · CVE-2026-26191

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.81.0

Description A flaw in the software installer pipeline allows a crafted software package to execute arbitrary commands as root on macOS and Linux, or as SYSTEM on Windows, when an uninstall is triggered. When packages such as .pkg, .deb, .rpm, .exe, or .msi are uploaded, metadata is extracted from the binary to generate uninstall scripts. This metadata is not properly sanitized, meaning a package with malicious values in its metadata fields can lead to unintended command execution on managed endpoints.

Recommendations Update to version 4.81.0. Avoid uploading software packages from untrusted or unverified sources. Manually inspect and edit auto-generated uninstall scripts before deployment.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-26191

GHSA-9VCR-G537-3W5V

GO-2026-5301

Affected Products

Fleet

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26191.json · Exploit
• https://github.com/fleetdm/fleet/security/advisories/GHSA-9vcr-g537-3w5v · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-5301 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9vcr-g537-3w5v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-26191 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26191 · Security Note
• https://github.com/fleetdm/fleet · Note
• https://github.com/fleetdm/fleet/releases/tag/fleet-v4.81.1 · Note
• https://t.me/cveNotify/163855 · Telegram Post