High severity8.8NVD Advisory· Published Mar 27, 2026· Updated Mar 31, 2026
CVE-2026-29180
CVE-2026-29180
Description
Fleet is open source device management software. Prior to 4.81.1, a broken access control vulnerability in Fleet's host transfer API allows a team maintainer to transfer hosts from any team into their own team, bypassing team isolation boundaries. Once transferred, the attacker gains full control over the stolen hosts, including the ability to execute scripts with root privileges. Version 4.81.1 patches the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/fleetdm/fleet/v4Go | < 4.81.1 | 4.81.1 |
Affected products
3- ghsa-coords2 versionspkg:golang/github.com/fleetdm/fleet/v4pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6
< 4.81.1+ 1 more
- (no CPE)range: < 4.81.1
- (no CPE)range: < 0.0.20260402T184258-150000.1.158.1
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-m2h6-4xpq-qw3mghsaADVISORY
- github.com/fleetdm/fleet/security/advisories/GHSA-m2h6-4xpq-qw3mnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-29180ghsaADVISORY
- github.com/fleetdm/fleet/releases/tag/fleet-v4.81.1ghsaWEB
News mentions
0No linked articles in our index yet.