NetSight
IP …
high7.1

CVE-2026-23517

Fleet has an Access Control vulnerability in debug/pprof endpoints

Impact

### Summary A broken access control issue in Fleet allowed authenticated users to access debug and profiling endpoints regardless of role. As a result, low-privilege users could view internal server diagnostics and trigger resource-intensive profiling operations. ### Impact Fleet’s debug/pprof endpoints are accessible to any authenticated user regardless of role, including the lowest-privilege “Observer” role. This allows low-privilege users to access sensitive server internals, including runtime profiling data and in-memory application state, and to trigger CPU-intensive profiling operations that could lead to denial of service. ### Patches - 4.78.3 - 4.77.1 - 4.76.2 - 4.75.2 - 4.53.3 ### Workarounds If an immediate upgrade is not possible, users should put the debug/pprof endpoints behind an IP allowlist. ### For more information If you have any questions or comments about this advisory: Email us at [security@fleetdm.com](mailto:security@fleetdm.com) Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw) ### Credits We thank @secfox-ai for responsibly reporting this issue.

Affected packages

EcosystemPackageAffectedFixed in
gogithub.com/fleetdm/fleet>= 4.78.0, < 4.78.34.78.3
gogithub.com/fleetdm/fleet/v4< 4.78.3-0.20260112221730-5c030e32a3a94.78.3-0.20260112221730-5c030e32a3a9

Affected products

VendorProductAffected versions
FleetdmFleet
before 4.53.3
from 4.75.0 before 4.75.2
from 4.76.0 before 4.76.2
from 4.78.0 before 4.78.3
Version 4.77.0

Weakness classification

CWE-862CWE-863

References