CVE-2026-29180

Aliases:GHSA-m2h6-4xpq-qw3mGO-2026-4892
Advisory lineage Upstream: 0 Downstream: 1
Analyzed
Published: 27 Mar 2026, 18:27
Last modified:31 Mar 2026, 18:54

Vulnerability Summary

Overall Risk (default)
medium
35/100
CVSS Score
8.8 HIGH
v3.1 (nvd)
EPSS Score
0.02% LOW
0% probability -0.03%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

27 Mar 2026, 18:27
Published
Vulnerability first disclosed
31 Mar 2026, 18:54
Last Modified
Vulnerability information updated

Description

Fleet is open source device management software. Prior to 4.81.1, a broken access control vulnerability in Fleet's host transfer API allows a team maintainer to transfer hosts from any team into their own team, bypassing team isolation boundaries. Once transferred, the attacker gains full control over the stolen hosts, including the ability to execute scripts with root privileges. Version 4.81.1 patches the issue.

CVSS Metrics

  • v4.0•MEDIUM•Score: 4.9CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
  • v4.0•MEDIUM•Score: 4.9CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • v3.1•HIGH•Score: 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.02%• Percentile: 6%

Techniques & Countermeasures

  • CWE-862•Missing Authorization

    The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Affected Systems

  • fleetdm•fleet

    < 4.81.1

  • github.com/fleetdm/fleet•v4

    < 4.81.1

References (4)