CVE-2026-34389: Fleetdm Fleet Auth Bypass Vulnerability

CVE-2026-34389 Overview

Fleet is open source device management software. Prior to version 4.81.0, Fleet contained a critical flaw in the user invitation flow where the email address provided during invite acceptance was not validated against the email address associated with the invite. An attacker who obtained a valid invite token could create an account under an arbitrary email address while inheriting the role granted by the invite, including global admin privileges.

Critical Impact

An attacker with access to a valid invite token can bypass email validation to create an account with arbitrary credentials while gaining the permissions of the original invite, potentially achieving global admin access.

Affected Products

• FleetDM Fleet versions prior to 4.81.0

Discovery Timeline

• 2026-03-27 - CVE-2026-34389 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-34389

Vulnerability Analysis

This vulnerability represents an authentication bypass (CWE-287) in Fleet's user invitation workflow. The core issue lies in the server-side validation logic during the invite acceptance process. When a user attempts to accept an invitation, the system properly validates that the invite token is legitimate, but fails to verify that the email address submitted in the acceptance request matches the email address to which the invitation was originally sent.

This design flaw creates a privilege escalation path where an attacker who gains access to a valid invitation token—whether through phishing, interception, or other means—can hijack the invitation and register an account using their own email address while inheriting all the permissions that were granted to the original invitee.

Root Cause

The root cause is improper input validation in the invite acceptance endpoint. The application accepts and processes the email address from the client request without cross-referencing it against the email address stored in the invitation record. This missing validation step allows an attacker to substitute their own email address while still claiming the role and permissions associated with the original invitation.

Attack Vector

The attack requires network access and can be executed remotely. An attacker must first obtain a valid, unexpired invitation token. This could be accomplished through various means such as:

1. Intercepting invitation emails through compromised email systems
2. Social engineering attacks targeting users who received invitations
3. Accessing shared communication channels where invite links may have been posted
4. Exploiting weak email security on corporate mail servers

Once in possession of the token, the attacker crafts a request to the invite acceptance endpoint, providing their own email address instead of the legitimate invitee's email. The server processes this request, creates an account for the attacker's email, and assigns the permissions from the original invitation—which could include global administrator privileges.

Detection Methods for CVE-2026-34389

Indicators of Compromise

• User accounts created with email addresses that differ from the original invitation target
• Multiple account creation attempts using the same invitation token
• Unusual patterns in user registration logs showing mismatches between invited and registered emails
• Unexpected administrator accounts appearing without corresponding legitimate invitation workflows

Detection Strategies

• Implement audit logging that captures both the invited email and the email used during account creation
• Monitor for anomalies where invitation tokens are redeemed by different email addresses than originally invited
• Review access logs for newly created admin accounts and verify their legitimacy through out-of-band confirmation

Monitoring Recommendations

• Enable comprehensive logging for all authentication and user management events in Fleet
• Set up alerts for any global admin account creation events
• Regularly audit user accounts against expected invitation records
• Monitor for patterns of invitation token reuse or rapid sequential account creation

How to Mitigate CVE-2026-34389

Immediate Actions Required

• Upgrade Fleet to version 4.81.0 or later immediately
• Audit all user accounts created through the invitation flow for legitimacy
• Review and revoke any suspicious accounts, particularly those with elevated privileges
• Invalidate all outstanding invitation tokens and reissue invitations after patching

Patch Information

FleetDM has addressed this vulnerability in version 4.81.0. The patch implements proper server-side validation to ensure the email address provided during invite acceptance matches the email address associated with the invitation token. Organizations should upgrade to version 4.81.0 or later as soon as possible. For more details, see the GitHub Security Advisory.

Workarounds

• Limit the distribution of invitation links to secure, verified communication channels only
• Implement short expiration times for invitation tokens to reduce the window of opportunity
• Enable multi-factor authentication for all accounts, especially those with administrative privileges
• Consider temporarily disabling the self-service invite acceptance workflow until patching is complete

# Verify Fleet version after upgrade
fleetctl version

# Review recently created users for audit
fleetctl get users --json | jq '.[] | select(.created_at > "2026-01-01")'