← Vulnerability feed

Vulnerability record · CVE-2020-26276 · published 17 December 2020

CVE-2020-26276: Fleetdm fleet authentication bypass by spoofing vulnerability

Fleetdm · Fleet

Fleet is an open source osquery manager. In Fleet before version 3.5.1, due to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from a SAML IdP. Users that configure Fleet with SSO login may be vulnerable to this issue. This issue is patched in 3.5.1. The fix was made using https://github.com/mattermost/xml-roundtrip-validator If upgrade to 3.5.1 is not possible, users should disable SSO authentication in Fleet.

9.8 CVSS 3.1 Critical EPSS 2.2% · top 18.2% CWE-290 · Authentication bypass by spoofing
9.8CVSS 3.1 base score, v2 6.8
2.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
10References
17 Jun 2026Last modified by NVD

Description

Fleet is an open source osquery manager. In Fleet before version 3.5.1, due to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from a SAML IdP. Users that configure Fleet with SSO login may be vulnerable to this issue. This issue is patched in 3.5.1. The fix was made using https://github.com/mattermost/xml-roundtrip-validator If upgrade to 3.5.1 is not possible, users should disable SSO authentication in Fleet.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/fleetdm/fleet/blob/master/CHANGELOG.md#fleet-351-dec-14-2020 Release NotesThird Party Advisory
https://github.com/fleetdm/fleet/commit/57812a532e5f749c8e18c6f6a652eca65c083607 PatchThird Party Advisory
https://github.com/fleetdm/fleet/security/advisories/GHSA-w3wf-cfx3-6gcx Third Party Advisory
https://github.com/mattermost/xml-roundtrip-validator Third Party Advisory
https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities Not ApplicableThird Party Advisory
https://github.com/fleetdm/fleet/blob/master/CHANGELOG.md#fleet-351-dec-14-2020 Release NotesThird Party Advisory
https://github.com/fleetdm/fleet/commit/57812a532e5f749c8e18c6f6a652eca65c083607 PatchThird Party Advisory
https://github.com/fleetdm/fleet/security/advisories/GHSA-w3wf-cfx3-6gcx Third Party Advisory
https://github.com/mattermost/xml-roundtrip-validator Third Party Advisory
https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities Not ApplicableThird Party Advisory

Track CVE-2020-26276 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.3CVE-2026-23518Fleetdm fleet improper verification of cryptographic signature vulnerabilityFleet is open source device management software. In versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3, a vulnerability in Fleet's Windows …EPSS 0.26%8.7CVE-2026-26062Fleetdm fleet improper input validation vulnerabilityFleet is open source device management software. Prior to version 4.81.0, Fleet contained a denial-of-service (DoS) issue in the gRPC Launcher `Publi…EPSS 0.54%8.7CVE-2026-26061Fleetdm fleet allocation without limits vulnerabilityFleet is open source device management software. Prior to 4.81.0, Fleet contained multiple unauthenticated HTTP endpoints that read request bodies wi…EPSS 0.48%8.2CVE-2026-24899Fleetdm fleet authentication bypass by spoofing vulnerabilityFleet is open source device management software. Prior to version 4.82.0, a vulnerability in Fleet's Windows MDM enrollment flow allows authenticatio…EPSS 0.38%8.2CVE-2026-23998Fleetdm fleet improper certificate validation vulnerabilityFleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet’s Windows MDM management endpoint could allow requ…EPSS 0.21%8.1CVE-2022-24841Fleetdm fleet improper access control vulnerabilityfleetdm/fleet is an open source device management, built on osquery. All versions of fleet making use of the teams feature are affected by this autho…EPSS 0.85%7.8CVE-2026-27806Fleetdm fleet os command injection vulnerabilityFleet is open source device management software. Prior to 4.81.1, the Orbit agent's FileVault disk encryption key rotation flow on collects a local u…EPSS 0.11%6.9CVE-2026-46356Fleetdm fleet authentication bypass by spoofing vulnerabilityFleet is open source device management software. Prior to version 4.80.1, a vulnerability in Fleet's IP extraction logic allows unauthenticated attac…EPSS 0.39%

Source: NIST National Vulnerability Database (record CVE-2020-26276), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.