FLEET · CVE-2026-126402 · Other
NO FIX YET · SEE WHAT TO DO
Fleet, a device management server, has an authorization flaw in its user administration API. A team administrator can create or change users so they gain admin roles on teams they do not manage, then deploy software and run scripts on those teams' hosts.
first public Oct 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running self-hosted or cloud Fleet servers before 4.89.0 that have more than one team and grant team administrator roles. Exposure requires an authenticated account with admin rights on at least one team. Single-team deployments with no team administrators are less exposed.
Not affected if no-team-admins, version-4.89.0-or-later
Who cares device-management, fleet, self-hosted
fleet version and compare it with the fixed release in the fix field.4.89.0 or later.Fleet before 4.89.0 contains an incorrect authorization flaw in its user administration API that accepts user creation or modification when the caller administers any one of the assigned teams. Authenticated team administrators can grant users administrator roles on other teams, then deploy software and execute scripts on those teams' hosts.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.