CVE-2026-34386CWE-89

Fleet vulnerable to SQL injection in MDM bootstrap package by authenticated team or global admin

Medium · published March 27, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
37.2
In the wild
Unconfirmed
What it is

Fleet is open source device management software. Prior to 4.81.0, a SQL injection vulnerability in Fleet's MDM bootstrap package configuration allows an authenticated user with Team Admin or Global Admin privileges to modify arbitrary team configurations, exfiltrate sensitive data from the Fleet database, and inject arbitrary content into team configs via direct API calls. Version 4.81.0 patches the issue.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
EPSS
0.00439 · 37.2th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-03-27T18:30Z
EPSS history
Timeline
  • 27 MAR 18:30Z
    Fleet vulnerable to SQL injection in MDM bootstrap package by authenticated team or global admin
    cvelistv5