CVE-2026-34385 json
Fleet's Apple MDM profile delivery has second-order SQL injection that can compromise the database
published 2026-03-27 7 mo ago modified 2026-10-26 13 d ago also EUVD-2026-16754 , GHSA-v895-833r-8c45 , GO-2026-4914
- cvss
- 8.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 10%
- public exploits
- 0
- none known
Summary
Fleet is open source device management software. Prior to 4.81.0, a second-order SQL injection vulnerability in Fleet's Apple MDM profile delivery pipeline could allow an attacker with a valid MDM enrollment certificate to exfiltrate or modify the contents of the Fleet database, including user credentials, API tokens, and device enrollment secrets. Version 4.81.0 patches the issue.
Patch / fix
- go github.com/fleetdm/fleet/v4 4.81.0
- fleetdm fleet 4.81.0
- govulncheck-vulndb openSUSE Leap 15.6 0.0.20260402T184258-150000.1.158.1
suse advisories SUSE-SU-2026:1205-1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
opensuse advisories openSUSE-SU-2026:21483-1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 7 mo ago
Exploit prediction
0.21% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.2 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U |
| CNA | 4.0 | 6.2 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/fleetdm/fleet/v4 | <4.81.0 |
4.81.0 |
Affected products
- fleetdm fleet
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
-
github.com
/fleetdm/fleet/security/advisories/GHSA-v895-833r-8c45
web, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-34385
advisory
-
github.com
/fleetdm/fleet
package
Sources
- CVE List CVE-2026-34385
- GitHub Advisory GHSA-v895-833r-8c45
- NVD CVE-2026-34385
- OSV GO-2026-4914
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.