CVE-2026-23517

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23517", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-13T18:22:43.979Z", "datePublished": "2026-01-21T21:45:34.561Z", "dateUpdated": "2026-01-22T16:49:56.246Z"}, "containers": {"cna": {"title": "Fleet has an Access Control vulnerability in debug/pprof endpoints", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U", "version": "4.0"}}], "references": [{"name": "https://github.com/fleetdm/fleet/security/advisories/GHSA-4r5r-ccr6-q6f6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-4r5r-ccr6-q6f6"}, {"name": "https://github.com/fleetdm/fleet/commit/5c030e32a3a9bc512355b5e1bf19636e4e6d0317", "tags": ["x_refsource_MISC"], "url": "https://github.com/fleetdm/fleet/commit/5c030e32a3a9bc512355b5e1bf19636e4e6d0317"}], "affected": [{"vendor": "fleetdm", "product": "fleet", "versions": [{"version": ">= 4.78.0, < 4.78.3", "status": "affected"}, {"version": ">= 4.77.0, < 4.77.1", "status": "affected"}, {"version": ">= 4.76.0, < 4.76.2", "status": "affected"}, {"version": ">= 4.75.0, < 4.75.2", "status": "affected"}, {"version": "< 4.53.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-21T21:45:34.561Z"}, "descriptions": [{"lang": "en", "value": "Fleet is open source device management software. A broken access control issue in versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 allowed authenticated users to access debug and profiling endpoints regardless of role. As a result, low-privilege users could view internal server diagnostics and trigger resource-intensive profiling operations. Fleet\u2019s debug/pprof endpoints are accessible to any authenticated user regardless of role, including the lowest-privilege \u201cObserver\u201d role. This allows low-privilege users to access sensitive server internals, including runtime profiling data and in-memory application state, and to trigger CPU-intensive profiling operations that could lead to denial of service. Versions 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 fix the issue. If an immediate upgrade is not possible, users should put the debug/pprof endpoints behind an IP allowlist as a workaround."}], "source": {"advisory": "GHSA-4r5r-ccr6-q6f6", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-22T15:10:55.676876Z", "id": "CVE-2026-23517", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T16:49:56.246Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23517", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-22T15:10:55.676876Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T15:10:56.685Z"}}], "cna": {"title": "Fleet has an Access Control vulnerability in debug/pprof endpoints", "source": {"advisory": "GHSA-4r5r-ccr6-q6f6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "fleetdm", "product": "fleet", "versions": [{"status": "affected", "version": ">= 4.78.0, < 4.78.3"}, {"status": "affected", "version": ">= 4.77.0, < 4.77.1"}, {"status": "affected", "version": ">= 4.76.0, < 4.76.2"}, {"status": "affected", "version": ">= 4.75.0, < 4.75.2"}, {"status": "affected", "version": "< 4.53.3"}]}], "references": [{"url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-4r5r-ccr6-q6f6", "name": "https://github.com/fleetdm/fleet/security/advisories/GHSA-4r5r-ccr6-q6f6", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/fleetdm/fleet/commit/5c030e32a3a9bc512355b5e1bf19636e4e6d0317", "name": "https://github.com/fleetdm/fleet/commit/5c030e32a3a9bc512355b5e1bf19636e4e6d0317", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Fleet is open source device management software. A broken access control issue in versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 allowed authenticated users to access debug and profiling endpoints regardless of role. As a result, low-privilege users could view internal server diagnostics and trigger resource-intensive profiling operations. Fleet\u2019s debug/pprof endpoints are accessible to any authenticated user regardless of role, including the lowest-privilege \u201cObserver\u201d role. This allows low-privilege users to access sensitive server internals, including runtime profiling data and in-memory application state, and to trigger CPU-intensive profiling operations that could lead to denial of service. Versions 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 fix the issue. If an immediate upgrade is not possible, users should put the debug/pprof endpoints behind an IP allowlist as a workaround."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-21T21:45:34.561Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23517", "state": "PUBLISHED", "dateUpdated": "2026-01-22T16:49:56.246Z", "dateReserved": "2026-01-13T18:22:43.979Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-21T21:45:34.561Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "fleet", "vendor": "fleetdm", "versions": [{"status": "affected", "version": ">= 4.78.0, < 4.78.3"}, {"status": "affected", "version": ">= 4.77.0, < 4.77.1"}, {"status": "affected", "version": ">= 4.76.0, < 4.76.2"}, {"status": "affected", "version": ">= 4.75.0, < 4.75.2"}, {"status": "affected", "version": "< 4.53.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*", "matchCriteriaId": "58B2870D-823A-4862-A51B-B3F86C60D89B", "versionEndExcluding": "4.53.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*", "matchCriteriaId": "E363A7DF-0880-44B8-82A6-0192D1D43471", "versionEndExcluding": "4.75.2", "versionStartIncluding": "4.75.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*", "matchCriteriaId": "53B5B8B6-F8C9-45E2-A160-D5834B1F3D61", "versionEndExcluding": "4.76.2", "versionStartIncluding": "4.76.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*", "matchCriteriaId": "B8118C02-5CB2-45D3-AE6E-90313FB29720", "versionEndExcluding": "4.78.3", "versionStartIncluding": "4.78.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:fleetdm:fleet:4.77.0:*:*:*:*:*:*:*", "matchCriteriaId": "AE525B6A-8AF1-4D33-8EE9-FFD6A1C4F3F8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Fleet is open source device management software. A broken access control issue in versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 allowed authenticated users to access debug and profiling endpoints regardless of role. As a result, low-privilege users could view internal server diagnostics and trigger resource-intensive profiling operations. Fleet\u2019s debug/pprof endpoints are accessible to any authenticated user regardless of role, including the lowest-privilege \u201cObserver\u201d role. This allows low-privilege users to access sensitive server internals, including runtime profiling data and in-memory application state, and to trigger CPU-intensive profiling operations that could lead to denial of service. Versions 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 fix the issue. If an immediate upgrade is not possible, users should put the debug/pprof endpoints behind an IP allowlist as a workaround."}, {"lang": "es", "value": "Fleet es un software de gesti\u00f3n de dispositivos de c\u00f3digo abierto. Un problema de control de acceso roto en versiones anteriores a 4.78.3, 4.77.1, 4.76.2, 4.75.2 y 4.53.3 permit\u00eda a los usuarios autenticados acceder a los puntos finales de depuraci\u00f3n y perfilado independientemente del rol. Como resultado, los usuarios con privilegios bajos pod\u00edan ver diagn\u00f3sticos internos del servidor y activar operaciones de perfilado que consumen muchos recursos. Los puntos finales debug/pprof de Fleet son accesibles para cualquier usuario autenticado independientemente del rol, incluido el rol 'Observer' con los privilegios m\u00e1s bajos. Esto permite a los usuarios con privilegios bajos acceder a elementos internos sensibles del servidor, incluidos datos de perfilado en tiempo de ejecuci\u00f3n y el estado de la aplicaci\u00f3n en memoria, y activar operaciones de perfilado intensivas en CPU que podr\u00edan llevar a una denegaci\u00f3n de servicio. Las versiones 4.78.3, 4.77.1, 4.76.2, 4.75.2 y 4.53.3 solucionan el problema. Si una actualizaci\u00f3n inmediata no es posible, los usuarios deber\u00edan colocar los puntos finales debug/pprof detr\u00e1s de una lista blanca de IP como soluci\u00f3n alternativa."}], "id": "CVE-2026-23517", "lastModified": "2026-06-17T10:21:42.730", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23517", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-22T15:10:55.676876Z", "version": "2.0.3"}}]}, "published": "2026-01-21T22:15:49.997", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/fleetdm/fleet/commit/5c030e32a3a9bc512355b5e1bf19636e4e6d0317"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-4r5r-ccr6-q6f6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T04:08:03.068298+00:00", "value": {"mitigation_remediation": ["Upgrade Fleet to version 4.78.3 or newer, which includes the fix for this issue", "If an upgrade cannot be performed immediately, place the debug/pprof endpoints behind an IP allowlist to restrict access to trusted administrators", "Disable the debug/pprof endpoints in production environments where they are not required for normal operation"], "summary": {"action": "Apply Patch", "impact": "Unauthorized access to debug/profiling endpoints exposing server diagnostics and enabling CPU\u2011intensive profiling leading to potential denial of service"}, "threat_synthesis": {"affected_systems": "Fleetdm Fleet versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 are affected. The vulnerability exists in the open\u2011source Fleet device management software, handling authentication but lacking role checks for the exposed endpoints.", "description_and_impact": "A broken access control flaw in the fleetdm Fleet application allows any authenticated user, including those with the lowest Observer role, to reach the debug and pprof endpoints. This can expose internal server diagnostics, runtime profiling data, and in\u2011memory application state. Because the endpoints support CPU\u2011heavy profiling operations, a malicious user could trigger denial of service by exhausting server resources.", "risk_and_exploitability": "The CVSS score of 6.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low exploitation probability at the time of this assessment. The vulnerability is not listed in the CISA KEV catalog. An attacker must have valid credentials and network access to the Fleet instance; the flaw is exploitable from anywhere the application is reachable. Successful exploitation enables data exposure and can lead to service degradation through repeated profiling calls."}}}}, "created": "2026-01-22T10:08:32.856235+00:00", "updated": "2026-04-18T04:15:05.874096+00:00", "vendors": ["fleetdm", "fleetdm$PRODUCT$fleet"]}