high8.1
CVE-2026-34385
Fleet's Apple MDM profile delivery has second-order SQL Injection that can compromise the database
Impact
Fleet is open source device management software. Prior to 4.81.0, a second-order SQL injection vulnerability in Fleet's Apple MDM profile delivery pipeline could allow an attacker with a valid MDM enrollment certificate to exfiltrate or modify the contents of the Fleet database, including user credentials, API tokens, and device enrollment secrets. Version 4.81.0 patches the issue.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/fleetdm/fleet/v4 | < 4.81.0 | 4.81.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Fleetdm | Fleet | before 4.81.0 |