What is CVE-2026-29180?

CVE-2026-29180 is a high-severity vulnerability in Fleetdm Fleet, classified under Missing Authorization. CVSS score: 8.8/10. Published 2026-03-27.

How severe is CVE-2026-29180?

High severity. CVSS v3 base score is 8.8 out of 10.

Auth bypass in Fleetdm Fleet

CVE-2026-29180

Fleet is open source device management software. Prior to 4.81.1, a broken access control vulnerability in Fleet's host transfer API allows a team maintainer to transfer hosts from any team into their own team, bypassing team isolation boundaries. Once transferred, the attacker gains full control over the stolen hosts, including the ability to execute scripts with root privileges. Version 4.81.1 patches the issue.

Vulnerability class: Broken Access Control

EPSS: 0.003 (24.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Fleetdm Fleet — versions < 4.81.1

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2026-29180?: CVE-2026-29180 is a high-severity vulnerability in Fleetdm Fleet, classified under Missing Authorization. CVSS score: 8.8/10. Published 2026-03-27.
How severe is CVE-2026-29180?: High severity. CVSS v3 base score is 8.8 out of 10.