Executive brief
Fleet is an open-source platform used by IT and security teams to manage and monitor laptops, servers, and other devices. A vulnerability in the server's log-processing component allows an attacker to crash the Fleet server by sending a single malicious request. This results in a total service outage, preventing administrators from managing their device fleet until the system is restored.
Technical details
A denial-of-service (DoS) vulnerability exists in the Fleet server's gRPC Launcher 'PublishLogs' endpoint due to improper input validation (CWE-20). The server fails to gracefully handle certain unexpected input values, leading to a process termination (crash). An attacker with a valid enrolled Launcher node key can trigger this crash by sending a single crafted gRPC request. While the attack requires authentication (a node key), it results in a complete loss of availability for the Fleet management console. The issue is resolved in version 4.81.0.
Affected products
- Fleet Device Management (fleetdm) Fleet < 4.81.0
Timeline
- 2026-02-20: patched: Version 4.81.0 released
- 2026-05-13: advisory: GitHub Security Advisory published
- 2026-05-14: disclosed: CVE published to NVD