Go/github.com/fleetdm/fleet/v4 CVE-2026-22808: medium 5.4, EPSS 0.25%
Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability in github.com/fleetdm/fleet
Action: Upgrade github.com/fleetdm/fleet/v4 to 4.75.2 or later.
go get github.com/fleetdm/fleet/v4@v4.75.2go get github.com/fleetdm/fleet/v4@v4.76.2go get github.com/fleetdm/fleet/v4@v4.77.1go get github.com/fleetdm/fleet/v4@v4.78.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.75.0 | 4.75.2 | - |
| 4.76.0 | 4.76.2 | - |
| 4.77.0 | 4.77.1 | - |
| 4.78.0 | 4.78.2 | - |
Fixed versions
| 4.75.2 | 4.76.2 | 4.77.1 | 4.78.2 |
Sources
- osv: GO-2026-4336
- nvd: CVE-2026-22808
- https://github.com/fleetdm/fleet/security/advisories/GHSA-gfpw-jgvr-cw4j
- https://github.com/fleetdm/fleet/commit/0e6c790803d1b4407c5b4b41a67a37864a3d3573
CVE-2026-22808 · published · modified · JSON