CVE-2026-34391— Fleet Vulnerable to Windows MDM cross-device command disclosure
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-34391
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Fleet Vulnerable to Windows MDM cross-device command disclosure
Source: NVD (National Vulnerability Database)
Vulnerability Description
Fleet is open source device management software. Prior to 4.81.1, a vulnerability in Fleet's Windows MDM command processing allows a malicious enrolled device to access MDM commands intended for other devices, potentially exposing sensitive configuration data such as WiFi credentials, VPN secrets, and certificate payloads across the entire Windows fleet. Version 4.81.1 patches the issue.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
对错误会话暴露数据元素
Source: NVD (National Vulnerability Database)
Vulnerability Title
Fleet 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Fleet是Fleet Device Management开源的一个设备管理平台，支持多种操作系统和设备，帮助 IT 和安全团队进行设备管理、漏洞报告、MDM 等操作。 Fleet 4.81.1之前版本存在安全漏洞，该漏洞源于Windows MDM命令处理不当，可能导致恶意设备访问其他设备的MDM命令，泄露敏感配置数据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-34391
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-34391
请登录查看更多情报信息。
Same Patch Batch · fleetdm · 2026-03-27 · 9 CVEs total
| CVE-2026-26061 | Fleet's unbounded request body read allows remote Denial of Service | |
| CVE-2026-26060 | Fleet: Password reset tokens remain valid after password change for 24 hours | |
| CVE-2026-29180 | Fleet's team maintainer can transfer hosts from any team via missing source team authoriza | |
| CVE-2026-34386 | Fleet vulnerable to SQL injection in MDM bootstrap package by authenticated team or globa | |
| CVE-2026-34385 | Fleet's Apple MDM profile delivery has second-order SQL injection that can compromise the | |
| CVE-2026-34387 | Fleet vulnerable to OS command injection via crafted software package metadata in uninstal | |
| CVE-2026-34388 | Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint | |
| CVE-2026-34389 | Fleet's user account creation via invite does not enforce invited email address |
IV. Related Vulnerabilities
Same product: fleet
- CVE-2026-27806
Fleet Affected by Local Privilege Escalation via Tcl Command - CVE-2026-34389
Fleet's user account creation via invite does not enforce in - CVE-2026-34388
Fleet vulnerable to Denial of Service via unhandled gRPC log - CVE-2026-34387
Fleet vulnerable to OS command injection via crafted softwar - CVE-2026-34386
Fleet vulnerable to SQL injection in MDM bootstrap package
Same vendor: fleetdm
- CVE-2026-27806
Fleet Affected by Local Privilege Escalation via Tcl Command - CVE-2026-34389
Fleet's user account creation via invite does not enforce in - CVE-2026-34388
Fleet vulnerable to Denial of Service via unhandled gRPC log - CVE-2026-34387
Fleet vulnerable to OS command injection via crafted softwar - CVE-2026-34386
Fleet vulnerable to SQL injection in MDM bootstrap package
Same weakness: CWE-488
- CVE-2026-23919
Insufficient isolation of JavaScript (Duktape) execution con - CVE-2026-27492
Lettermint Node.js SDK leaks email properties to unintended - CVE-2026-23844
Whisper Money has IDOR Vulnerability on sync/balances endpoi - CVE-2026-23646
OpenProject users can delete other user's session, causing t - CVE-2025-24934
SO_REUSEPORT_LB breaks connect(2) for UDP sockets
V. Comments for CVE-2026-34391
No comments yet