CVE-2026-34391

The record

Fleet is open source device management software. Prior to 4.81.1, a vulnerability in Fleet's Windows MDM command processing allows a malicious enrolled device to access MDM commands intended for other devices, potentially exposing sensitive configuration data such as WiFi credentials, VPN secrets, and certificate payloads across the entire Windows fleet. Version 4.81.1 patches the issue.

Affected packages

Related vulnerabilities

• CVE-2026-114637 Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the… CWE-488
• CVE-2026-112921 Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter… CWE-488
• CVE-2026-84685 The react-native-auth0 SDK's web platform implementation does not scope its in-memory… CWE-488
• CVE-2026-86492 In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft… CWE-488
• CVE-2026-80231 A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given… CWE-488
• CVE-2026-82367 Exposure of Data Element to Wrong Session vulnerability in ash-project ash_graphql can… CWE-488
• CVE-2026-71850 Hono is a Web application framework that provides support for any JavaScript runtime. CWE-488
• CVE-2026-14621 A vulnerability has been found in FederatedAI FATE up to 2.2.0. CWE-488