CVE-2026-34385 — Vulnetix

Try Vulnetix Request Demo

CVE-2026-34385 PUBLISHED CVSS 6.199999809265137 MEDIUM

Fleet is open source device management software. Prior to 4.81.0, a second-order SQL injection vulnerability in Fleet's Apple MDM profile delivery pipeline could allow an attacker with a valid MDM enrollment certificate to exfiltrate or modify the contents of the Fleet database, including user credentials, API tokens, and device enrollment secrets. Version 4.81.0 patches the issue.

EPSS 0.02% · 4.3th percentile

Risk Scores

CVSS v4.0

6.199999809265137

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

EPSS Score

0.02%

4.3th percentile

Affected Products

Vendor	Product	Versions
fleetdm	fleet	< 4.81.0, < 4.81.0, < 4.81.0
github.com	fleetdm/fleet/v4	0

Timeline

Mar 27, 2026 Coalition ESS Score
Mar 27, 2026 CVE Published
Mar 28, 2026 EPSS Score
Mar 31, 2026 Security Advisory
Mar 31, 2026 CVE Updated
Apr 7, 2026 PoC Published

References

Open in Interactive Console →