CVE-2026-34388mediumCWE-703

CVE-2026-34388: fallo de gravedad media en fleetdm fleet

Fleet vulnerable to Denial of Service via unhandled gRPC log type in launcher endpoint

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear fleet+ Monitorear github.com/fleetdm/fleet/v4

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.6epss 0.3%
Fleet is open source device management software. Prior to 4.81.0, a denial-of-service vulnerability in Fleet's gRPC Launcher endpoint allows an authenticated host to crash the entire Fleet server process by sending an unexpected log type value. The server terminates immediately, disrupting all connected hosts, MDM enrollments, and API consumers. Version 4.81.0 patches the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U
Productos afectados
fleetdm · fleet
CVEs relacionadas — fleetdm fleet

En el mismo producto, de las más peligrosas a las menos.

CVE-2020-26276CRITICALSAML authentication vulnerability in FleetEPSS 2.2%CVE-2021-21296LOWDenial-of-service in FleetEPSS 2.0%CVE-2026-34387MEDIUMFleet vulnerable to OS command injection via crafted software package metadata in uninstall scriptsEPSS 1.3%CVE-2022-23600MEDIUMLimited ability to spoof SAML authentication with missing audience verificationEPSS 0.9%CVE-2022-24841MEDIUMImproper Authorization in github.com/fleetdm/fleetEPSS 0.8%CVE-2026-26191MEDIUMFleet vulnerable to OS command injection in software packagesEPSS 0.8%