{"id":"CVE-2026-26191","sourceIdentifier":"security-advisories@github.com","published":"2026-05-14T20:17:02.173","lastModified":"2026-10-26T14:10:00.130","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet's software installer pipeline could allow a crafted software package to execute arbitrary commands as root (macOS/Linux) or SYSTEM (Windows) on managed endpoints when an uninstall is triggered. When a software package (.pkg, .deb, .rpm, .exe, or .msi) is uploaded to Fleet, metadata is extracted from the package binary and used to generate uninstall scripts. In affected versions, this metadata is not properly sanitized before being included in the generated scripts. A specially crafted package containing malicious values in its metadata fields could result in unintended command execution when the uninstall script runs on managed endpoints. Version 4.81.0 contains a patch. If an immediate upgrade is not possible, administrators should avoid uploading software packages obtained from untrusted or unverified sources. Additionally, administrators can manually inspect and edit auto-generated uninstall scripts before deployment."},{"lang":"es","value":"Fleet es un software de gestión de dispositivos de código abierto. Antes de la versión 4.81.0, una vulnerabilidad en la cadena de instalación de software de Fleet podría permitir que un paquete de software manipulado ejecute comandos arbitrarios como root (macOS/Linux) o SYSTEM (Windows) en los puntos finales gestionados cuando se activa una desinstalación. Cuando un paquete de software (.pkg, .deb, .rpm, .exe o .msi) se carga en Fleet, se extraen metadatos del binario del paquete y se utilizan para generar scripts de desinstalación. En las versiones afectadas, estos metadatos no se sanean correctamente antes de ser incluidos en los scripts generados. Un paquete especialmente manipulado que contenga valores maliciosos en sus campos de metadatos podría resultar en la ejecución de comandos no deseados cuando el script de desinstalación se ejecuta en los puntos finales gestionados. La versión 4.81.0 contiene un parche. Si una actualización inmediata no es posible, los administradores deben evitar cargar paquetes de software obtenidos de fuentes no confiables o no verificadas. Además, los administradores pueden inspeccionar y editar manualmente los scripts de desinstalación autogenerados antes de la implementación."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"fleetdm","product":"fleet","versions":[{"version":"< 4.81.1","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.0,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-15T14:15:05.427993Z","id":"CVE-2026-26191","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-78"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*","versionEndExcluding":"4.81.0","matchCriteriaId":"84AB2C74-C556-4B42-9A54-A5B201D1BDC3"}]}]}],"references":[{"url":"https://github.com/fleetdm/fleet/releases/tag/fleet-v4.81.1","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/fleetdm/fleet/security/advisories/GHSA-9vcr-g537-3w5v","source":"security-advisories@github.com","tags":["Vendor Advisory"]}]}