High severity8.8NVD Advisory· Published Mar 27, 2026· Updated Mar 31, 2026
CVE-2026-29180
CVE-2026-29180
Description
Fleet is open source device management software. Prior to 4.81.1, a broken access control vulnerability in Fleet's host transfer API allows a team maintainer to transfer hosts from any team into their own team, bypassing team isolation boundaries. Once transferred, the attacker gains full control over the stolen hosts, including the ability to execute scripts with root privileges. Version 4.81.1 patches the issue.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/fleetdm/fleet/v4Go | < 4.81.1 | 4.81.1 |
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- github.com/advisories/GHSA-m2h6-4xpq-qw3mghsaADVISORY
- github.com/fleetdm/fleet/security/advisories/GHSA-m2h6-4xpq-qw3mnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-29180ghsaADVISORY
- github.com/fleetdm/fleet/releases/tag/fleet-v4.81.1ghsaWEB
News mentions
0No linked articles in our index yet.