GO-2026-4334
NoneCVSS
—
EPSS
—
Published
Feb 3, 2026
CISA due date
—
The record
Fleet has an Access Control vulnerability in debug/pprof endpoints in github.com/fleetdm/fleet
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/fleetdm/fleet | 4.75.0 | 4.75.2 |
| Go | github.com/fleetdm/fleet | 4.76.0 | 4.76.2 |
| Go | github.com/fleetdm/fleet | 4.77.0 | 4.77.1 |
| Go | github.com/fleetdm/fleet | 4.78.0 | 4.78.3 |
| Go | github.com/fleetdm/fleet/v4 | 0 | 4.78.3-0.20260112221730-5c030e32a3a9 |
| Go | github.com/fleetdm/fleet/v4 | 4.75.0 | 4.75.2 |
| go | github.com/fleetdm/fleet | 4.75.0 | 4.75.2 |
| go | github.com/fleetdm/fleet | 4.76.0 | 4.76.2 |
| go | github.com/fleetdm/fleet | 4.77.0 | 4.77.1 |
| go | github.com/fleetdm/fleet | 4.78.0 | 4.78.3 |
Related vulnerabilities
- CVE-2026-23517 Fleet is open source device management software. Same vulnerability
- GO-2026-4336 Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability in… Also affects github.com/fleetdm/fleet
- GO-2026-4335 Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment in… Also affects github.com/fleetdm/fleet
- CVE-2026-23518 Fleet is open source device management software. Also affects github.com/fleetdm/fleet
- CVE-2026-22808 fleetdm/fleet is open source device management software. Also affects github.com/fleetdm/fleet
- GHSA-2v6m-6xw3-6467 Fleet: Sensitive Google Calendar credentials disclosed to low-privileged users Also affects github.com/fleetdm/fleet/v4
- GHSA-5jvp-m9h4-253h Fleet: Authorization Bypass in certificate template batch deletion for team administrators Also affects github.com/fleetdm/fleet/v4
- GHSA-9pm7-6g36-6j78 Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint Also affects github.com/fleetdm/fleet/v4