Go/github.com/fleetdm/fleet/v4 CVE-2026-22808: medium 5.4, EPSS 0.25%

Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability

Action: Upgrade github.com/fleetdm/fleet/v4 to 4.43.5-0.20260111020427-0e6c790803d1 or later.

go get github.com/fleetdm/fleet/v4@v4.43.5-0.20260111020427-0e6c790803d1

Affected

Fixed versions

Sources

• osv: GHSA-gfpw-jgvr-cw4j#Go/github.com/fleetdm/fleet/v4
• nvd: CVE-2026-22808
• https://github.com/fleetdm/fleet/security/advisories/GHSA-gfpw-jgvr-cw4j
• https://github.com/fleetdm/fleet/commit/0e6c790803d1b4407c5b4b41a67a37864a3d3573
• https://github.com/fleetdm/fleet

CVE-2026-22808 · published 2026-01-20T20:52:17Z · modified 2026-02-03T22:41:17.423857Z · JSON