Go/github.com/fleetdm/fleet CVE-2026-23518: critical 9.8, EPSS 0.25%
Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment
Action: Upgrade github.com/fleetdm/fleet to 4.43.5-0.20260112202845-e225ef57912c or later.
go get github.com/fleetdm/fleet@v4.78.3go get github.com/fleetdm/fleet@v4.77.1go get github.com/fleetdm/fleet@v4.76.2go get github.com/fleetdm/fleet@v4.75.2go get github.com/fleetdm/fleet@v4.43.5-0.20260112202845-e225ef57912cAffected
| introduced | fixed | last affected |
|---|---|---|
| 4.78.0 | 4.78.3 | - |
| 4.77.0 | 4.77.1 | - |
| 4.76.0 | 4.76.2 | - |
| 4.75.0 | 4.75.2 | - |
| 0 | 4.43.5-0.20260112202845-e225ef57912c | - |
Fixed versions
| 4.78.3 | 4.77.1 | 4.76.2 | 4.75.2 | 4.43.5-0.20260112202845-e225ef57912c |
Sources
- osv: GHSA-63m5-974w-448v
- nvd: CVE-2026-23518
- https://github.com/fleetdm/fleet/security/advisories/GHSA-63m5-974w-448v
- https://github.com/fleetdm/fleet/commit/e225ef57912c8f4ac8977e24b5ebe1d9fd875257
- https://github.com/fleetdm/fleet
- https://pkg.go.dev/vuln/GO-2026-4335
CVE-2026-23518 · published · modified · JSON