GHSA-X67P-9M2R-FXQV Fleet server may terminate unexpectedly when handling certain gRPC requests

Summary Fleet contained a denial-of-service DoS issue in the gRPC Launcher PublishLogs endpoint. In affected versions, certain unexpected input values were not handled gracefully, which could cause the Fleet server process to terminate while processing an authenticated request from an enrolled...

PT-2026-40970

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.81.0 Description A denial-of-service DoS issue exists in the gRPC Launcher "PublishLogs" endpoint. Certain unexpected input values are not handled gracefully, which can cause the server process to terminate while...

GHSA-MH2Q-Q3FH-2475 vulnerabilities

Vulnerabilities for packages: cadvisor-fips, vexctl, chartmuseum-fips, tetragon, haproxy-ingress, crossplane-provider-azure-servicefabric, litestream, crossplane-provider-azure-orbital, vertical-pod-autoscaler-fips, commercial-grafana, amazon-cloudwatch-agent-operator, skopeo-fips,...

CVE-2026-29181 vulnerabilities

Vulnerabilities for packages: cadvisor-fips, vexctl, chartmuseum-fips, tetragon, haproxy-ingress, crossplane-provider-azure-servicefabric, litestream, crossplane-provider-azure-orbital, vertical-pod-autoscaler-fips, commercial-grafana, amazon-cloudwatch-agent-operator, skopeo-fips,...

PT-2026-32407

Incorrect Authorization CWE-863 in Kibana can lead to cross-space information disclosure via Privilege Abuse CAPEC-122. A user with Fleet agent management privileges in one Kibana space can retrieve Fleet Server policy details from other spaces through an internal enrollment endpoint. The endpoin...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: multus-cni-fips, cloudflared-fips, grafana-operator, kube-rbac-proxy-fips, argo-workflows-fips, cadvisor-fips, nri-apache-fips, keda-fips, vexctl, chartmuseum-fips, nri-f5-fips, prometheus-pushgateway-fips, x509-certificate-exporter-fips, tetragon,...

Incorrect Authorization

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Incorrect Authorization via the enrollment endpoint. An attacker can access Fleet Server policy details from unauthorized spaces b...

EUVD-2026-20523

Incorrect Authorization CWE-863 in Kibana can lead to cross-space information disclosure via Privilege Abuse CAPEC-122. A user with Fleet agent management privileges in one Kibana space can retrieve Fleet Server policy details from other spaces through an internal enrollment endpoint. The endpoin...

CVE-2026-33460

Incorrect Authorization CWE-863 in Kibana can lead to cross-space information disclosure via Privilege Abuse CAPEC-122. A user with Fleet agent management privileges in one Kibana space can retrieve Fleet Server policy details from other spaces through an internal enrollment endpoint. The endpoin...

CVE-2026-33460 Incorrect Authorization in Kibana Fleet Leading to Information Disclosure

Incorrect Authorization CWE-863 in Kibana can lead to cross-space information disclosure via Privilege Abuse CAPEC-122. A user with Fleet agent management privileges in one Kibana space can retrieve Fleet Server policy details from other spaces through an internal enrollment endpoint. The endpoin...

GHSA-W254-4HP5-7CVV Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint

Summary A Denial of Service vulnerability in Fleet's gRPC Launcher endpoint allows an authenticated host to crash the entire Fleet server process by sending an unexpected log type value. The server terminates immediately, disrupting all connected hosts, MDM enrollments, and API consumers. Impact ...

CVE-2026-34388

Fleet is open source device management software. Prior to 4.81.0, a denial-of-service vulnerability in Fleet's gRPC Launcher endpoint allows an authenticated host to crash the entire Fleet server process by sending an unexpected log type value. The server terminates immediately, disrupting all...

Fleet's unbounded request body read allows remote Denial of Service

Summary Fleet contained multiple unauthenticated HTTP endpoints that read request bodies without enforcing a size limit. An unauthenticated attacker could exploit this behavior by sending large or repeated HTTP payloads, causing excessive memory allocation and resulting in a denial-of-service DoS...

GHSA-8FJ7-8H3W-XWFM vulnerabilities

Vulnerabilities for packages: ksops, flux-operator, kube-rbac-proxy-fips, crossplane-provider-aws-kinesis, harbor-fips, crossplane-provider-aws-lambda, amazon-ssm-agent-fips, crossplane-provider-terraform, tempo-fips, kube-vip-fips, bento, pulumi-language-java,...

CVE-2026-27141 vulnerabilities

Vulnerabilities for packages: ksops, flux-operator, kube-rbac-proxy-fips, crossplane-provider-aws-kinesis, harbor-fips, crossplane-provider-aws-lambda, amazon-ssm-agent-fips, crossplane-provider-terraform, tempo-fips, kube-vip-fips, bento, pulumi-language-java,...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the JWT verification process. An attacker can gain unauthorized enrollment of rogue devices by submitting a forged JWT with arbitrary identity claims, as the system fails to verify th...

EUVD-2021-24413

Malware in sbrugna...

EUVD-2023-50858

Malicious code in bioql PyPI...

EUVD-2024-46267

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2021-37937

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was found with how API keys are created with the Fleet-Server service account. When an API key is created with a service account, it is possible that t...