CVE-2026-34386: Fleetdm Fleet SQLi Vulnerability

CVE-2026-34386 Overview

Fleet is open source device management software. Prior to version 4.81.0, a SQL injection vulnerability exists in Fleet's MDM bootstrap package configuration that allows an authenticated user with Team Admin or Global Admin privileges to modify arbitrary team configurations, exfiltrate sensitive data from the Fleet database, and inject arbitrary content into team configs via direct API calls. This vulnerability represents a significant security risk for organizations using Fleet for mobile device management (MDM) operations.

Critical Impact

Authenticated attackers with administrative privileges can exploit this SQL injection vulnerability to exfiltrate sensitive data from the Fleet database, modify arbitrary team configurations, and potentially compromise the integrity of managed device fleets.

Affected Products

• FleetDM Fleet versions prior to 4.81.0
• Fleet MDM bootstrap package configuration component
• Fleet API endpoints handling team configurations

Discovery Timeline

• 2026-03-27 - CVE CVE-2026-34386 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-34386

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) resides within Fleet's MDM bootstrap package configuration functionality. The vulnerability allows authenticated users with elevated privileges (Team Admin or Global Admin) to manipulate SQL queries through the API, bypassing normal input validation controls. While authentication is required to exploit this flaw, the impact is severe as successful exploitation enables data exfiltration, configuration tampering, and potential lateral movement within the Fleet infrastructure.

The attack requires network access and low complexity to execute, but the authentication prerequisite somewhat limits the immediate exposure. Organizations relying on Fleet for device management should consider this vulnerability a priority due to the sensitive nature of MDM configurations and the potential for compromising managed endpoints.

Root Cause

The root cause of CVE-2026-34386 is improper input sanitization in the MDM bootstrap package configuration API endpoints. User-supplied input is incorporated into SQL queries without adequate parameterization or escaping, creating a classic SQL injection attack surface. The vulnerable code path accepts configuration data through direct API calls and constructs database queries that include unsanitized user input, allowing attackers to inject malicious SQL statements.

Attack Vector

The attack vector for this vulnerability is network-based, requiring the attacker to have authenticated access to the Fleet management interface with Team Admin or Global Admin privileges. The exploitation flow involves:

1. An authenticated attacker with administrative privileges accesses the Fleet API
2. The attacker crafts malicious input containing SQL injection payloads targeting the MDM bootstrap package configuration endpoints
3. The unsanitized input is processed by the server and incorporated into SQL queries
4. The injected SQL statements execute against the Fleet database, enabling data exfiltration, configuration modification, or content injection

The vulnerability is exploited through direct API calls rather than through the web interface, requiring knowledge of the Fleet API structure. For detailed technical information about the vulnerability mechanism, refer to the GitHub Security Advisory GHSA-9p23-p2m4-2r4m.

Detection Methods for CVE-2026-34386

Indicators of Compromise

• Unusual or malformed API requests to MDM bootstrap package configuration endpoints
• Database query logs showing unexpected SQL syntax or injection patterns
• Unauthorized modifications to team configurations not attributable to legitimate administrator actions
• Anomalous data access patterns in Fleet database audit logs

Detection Strategies

• Monitor Fleet API access logs for suspicious requests containing SQL metacharacters (single quotes, semicolons, UNION keywords, comment sequences)
• Implement database query logging and alert on queries with unexpected structure or execution patterns
• Enable detailed audit logging for all administrative actions within Fleet
• Deploy web application firewall (WAF) rules to detect and block SQL injection attempts

Monitoring Recommendations

• Establish baseline behavior for administrative API usage and alert on deviations
• Configure real-time alerting for database errors that may indicate injection attempts
• Review team configuration changes regularly for unauthorized modifications
• Monitor for data exfiltration indicators such as large query result sets or unusual database read patterns

How to Mitigate CVE-2026-34386

Immediate Actions Required

• Upgrade Fleet to version 4.81.0 or later immediately
• Audit administrative user accounts and remove unnecessary Team Admin or Global Admin privileges
• Review Fleet database and team configurations for signs of unauthorized modification
• Implement network segmentation to restrict API access to trusted networks only

Patch Information

FleetDM has released version 4.81.0 which patches this SQL injection vulnerability. Organizations should update their Fleet installations to this version or later as soon as possible. The patch implements proper input parameterization for the MDM bootstrap package configuration API endpoints.

For official patch details and release notes, see the GitHub Security Advisory.

Workarounds

• Restrict API access to the MDM bootstrap package configuration endpoints using network-level controls until patching is possible
• Implement additional authentication layers or IP allowlisting for administrative API access
• Deploy a WAF with SQL injection detection rules in front of Fleet API endpoints
• Reduce the number of users with Team Admin or Global Admin privileges to minimize attack surface

# Example: Network-level restriction using iptables
# Restrict Fleet API access to trusted admin network only
iptables -A INPUT -p tcp --dport 8080 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP