XSS in Fleetdm Fleet
CVE-2026-22808
fleetdm/fleet is open source device management software. Prior to versions 4.78.2, 4.77.1, 4.76.2, 4.75.2, and 4.53.3, if Windows MDM is enabled, an unauthenticated attacker can exploit this XSS vulnerability to steal a Fleet administrator's authentication token (FLEET::auth_token) from localStorage. This could allow unauthorized access to Fleet, including administrative access, visibility into device data, and modification of configuration. Versions 4.78.2, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 fix the issue. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.002 (11.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Fleetdm Fleet — versions >= 4.77.0, < 4.77.1, >= 4.78.0, < 4.78.2, < 4.53.3
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-22808?
- CVE-2026-22808 is a medium-severity vulnerability in Fleetdm Fleet, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2026-01-21.
- How severe is CVE-2026-22808?
- Medium severity. CVSS v3 base score is 5.4 out of 10.