Vulnerability-Lookup

FKIE_CVE-2026-23517

Vulnerability from fkie_nvd - Published: 2026-01-21 22:15 - Updated: 2026-02-27 16:16

Severity ?

8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Summary

Fleet is open source device management software. A broken access control issue in versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 allowed authenticated users to access debug and profiling endpoints regardless of role. As a result, low-privilege users could view internal server diagnostics and trigger resource-intensive profiling operations. Fleet’s debug/pprof endpoints are accessible to any authenticated user regardless of role, including the lowest-privilege “Observer” role. This allows low-privilege users to access sensitive server internals, including runtime profiling data and in-memory application state, and to trigger CPU-intensive profiling operations that could lead to denial of service. Versions 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 fix the issue. If an immediate upgrade is not possible, users should put the debug/pprof endpoints behind an IP allowlist as a workaround.

References

	URL	Tags
	security-advisories@github.com	https://github.com/fleetdm/fleet/commit/5c030e32a3a9bc512355b5e1bf19636e4e6d0317	Patch
	security-advisories@github.com	https://github.com/fleetdm/fleet/security/advisories/GHSA-4r5r-ccr6-q6f6	Vendor Advisory

Impacted products

Vendor	Product	Version
fleetdm	fleet	*
fleetdm	fleet	*
fleetdm	fleet	*
fleetdm	fleet	*
fleetdm	fleet	4.77.0

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "58B2870D-823A-4862-A51B-B3F86C60D89B",
              "versionEndExcluding": "4.53.3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E363A7DF-0880-44B8-82A6-0192D1D43471",
              "versionEndExcluding": "4.75.2",
              "versionStartIncluding": "4.75.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "53B5B8B6-F8C9-45E2-A160-D5834B1F3D61",
              "versionEndExcluding": "4.76.2",
              "versionStartIncluding": "4.76.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B8118C02-5CB2-45D3-AE6E-90313FB29720",
              "versionEndExcluding": "4.78.3",
              "versionStartIncluding": "4.78.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:fleetdm:fleet:4.77.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "AE525B6A-8AF1-4D33-8EE9-FFD6A1C4F3F8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Fleet is open source device management software. A broken access control issue in versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 allowed authenticated users to access debug and profiling endpoints regardless of role. As a result, low-privilege users could view internal server diagnostics and trigger resource-intensive profiling operations. Fleet\u2019s debug/pprof endpoints are accessible to any authenticated user regardless of role, including the lowest-privilege \u201cObserver\u201d role. This allows low-privilege users to access sensitive server internals, including runtime profiling data and in-memory application state, and to trigger CPU-intensive profiling operations that could lead to denial of service. Versions 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 fix the issue. If an immediate upgrade is not possible, users should put the debug/pprof endpoints behind an IP allowlist as a workaround."
    },
    {
      "lang": "es",
      "value": "Fleet es un software de gesti\u00f3n de dispositivos de c\u00f3digo abierto. Un problema de control de acceso roto en versiones anteriores a 4.78.3, 4.77.1, 4.76.2, 4.75.2 y 4.53.3 permit\u00eda a los usuarios autenticados acceder a los puntos finales de depuraci\u00f3n y perfilado independientemente del rol. Como resultado, los usuarios con privilegios bajos pod\u00edan ver diagn\u00f3sticos internos del servidor y activar operaciones de perfilado que consumen muchos recursos. Los puntos finales debug/pprof de Fleet son accesibles para cualquier usuario autenticado independientemente del rol, incluido el rol \u0027Observer\u0027 con los privilegios m\u00e1s bajos. Esto permite a los usuarios con privilegios bajos acceder a elementos internos sensibles del servidor, incluidos datos de perfilado en tiempo de ejecuci\u00f3n y el estado de la aplicaci\u00f3n en memoria, y activar operaciones de perfilado intensivas en CPU que podr\u00edan llevar a una denegaci\u00f3n de servicio. Las versiones 4.78.3, 4.77.1, 4.76.2, 4.75.2 y 4.53.3 solucionan el problema. Si una actualizaci\u00f3n inmediata no es posible, los usuarios deber\u00edan colocar los puntos finales debug/pprof detr\u00e1s de una lista blanca de IP como soluci\u00f3n alternativa."
    }
  ],
  "id": "CVE-2026-23517",
  "lastModified": "2026-02-27T16:16:14.830",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "UNREPORTED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-01-21T22:15:49.997",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/fleetdm/fleet/commit/5c030e32a3a9bc512355b5e1bf19636e4e6d0317"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-4r5r-ccr6-q6f6"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

CVE-2026-23517 (GCVE-0-2026-23517)

Vulnerability from cvelistv5 – Published: 2026-01-21 21:45 – Updated: 2026-01-22 16:49

Title

Fleet has an Access Control vulnerability in debug/pprof endpoints

Summary

Severity ?

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M

References

URL

Tags

	https://github.com/fleetdm/fleet/security/advisor…	x_refsource_CONFIRM
	https://github.com/fleetdm/fleet/commit/5c030e32a…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	fleetdm	fleet	Affected: >= 4.78.0, < 4.78.3 Affected: >= 4.77.0, < 4.77.1 Affected: >= 4.76.0, < 4.76.2 Affected: >= 4.75.0, < 4.75.2 Affected: < 4.53.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-23517",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-22T15:10:55.676876Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-22T16:49:56.246Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "fleet",
          "vendor": "fleetdm",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.78.0, \u003c 4.78.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.77.0, \u003c 4.77.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.76.0, \u003c 4.76.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.75.0, \u003c 4.75.2"
            },
            {
              "status": "affected",
              "version": "\u003c 4.53.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Fleet is open source device management software. A broken access control issue in versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 allowed authenticated users to access debug and profiling endpoints regardless of role. As a result, low-privilege users could view internal server diagnostics and trigger resource-intensive profiling operations. Fleet\u2019s debug/pprof endpoints are accessible to any authenticated user regardless of role, including the lowest-privilege \u201cObserver\u201d role. This allows low-privilege users to access sensitive server internals, including runtime profiling data and in-memory application state, and to trigger CPU-intensive profiling operations that could lead to denial of service. Versions 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 fix the issue. If an immediate upgrade is not possible, users should put the debug/pprof endpoints behind an IP allowlist as a workaround."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-21T21:45:34.561Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/fleetdm/fleet/security/advisories/GHSA-4r5r-ccr6-q6f6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-4r5r-ccr6-q6f6"
        },
        {
          "name": "https://github.com/fleetdm/fleet/commit/5c030e32a3a9bc512355b5e1bf19636e4e6d0317",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fleetdm/fleet/commit/5c030e32a3a9bc512355b5e1bf19636e4e6d0317"
        }
      ],
      "source": {
        "advisory": "GHSA-4r5r-ccr6-q6f6",
        "discovery": "UNKNOWN"
      },
      "title": "Fleet has an Access Control vulnerability in debug/pprof endpoints"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-23517",
    "datePublished": "2026-01-21T21:45:34.561Z",
    "dateReserved": "2026-01-13T18:22:43.979Z",
    "dateUpdated": "2026-01-22T16:49:56.246Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

FKIE_CVE-2026-23517

CVE-2026-23517 (GCVE-0-2026-23517)

Tags

Sightings

Nomenclature