Vulnerability · Published Mar 27, 2026 · Assigned by GitHub_M
CVE-2026-34388Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint
Medium 6.6
In plain English
A medium-severity security flaw in fleet from fleetdm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Fleet is open source device management software. Prior to 4.81.0, a denial-of-service vulnerability in Fleet's gRPC Launcher endpoint allows an authenticated host to crash the entire Fleet server process by sending an unexpected log type value. The server terminates immediately, disrupting all connected hosts, MDM enrollments, and API consumers. Version 4.81.0 patches the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/fleetdm/fleet/v4 | 4.81.0 | GO-2026-4915 |
| Go | github.com/fleetdm/fleet/v4 | 4.81.0 | GHSA-w254-4hp5-7cvv |
Affected products (as reported)
Weakness: CWE-703 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
References
- https://github.com/fleetdm/fleet/security/advisories/GHSA-w254-4hp5-7cvv x_refsource_CONFIRM