CVE-2020-26276 SAML authentication vulnerability in Fleet

What is CVE-2020-26276?

CVE-2020-26276 is a critical authentication bypass vulnerability in fleetdm fleet, published on 17 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Fleet is an open source osquery manager. In Fleet before version 3.5.1, due to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from a SAML IdP. Users that configure Fleet with SSO login may be vulnerable to this issue. This issue is patched in 3.5.1. The fix was made using https://github.com/mattermost/xml-roundtrip-validator If upgrade to 3.5.1 is not possible, users should disable SSO authentication in Fleet.

Weakness: CWE-290

Which versions are affected by CVE-2020-26276?

2 open source packages ship an affected version, including github.com/fleetdm/fleet/v4. It affects 1 product.

Products include Fleetdm Fleet.

How do I fix CVE-2020-26276?

Upgrade github.com/fleetdm/fleet/v4 to 3.5.1 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2020-26276 being exploited?

There is no known exploitation of CVE-2020-26276 in the wild and no public exploit code.

Other vulnerabilities in fleetdm fleet

• CVE-2026-103264 Fleet before 4.87.0 Authentication Bypass via Device Identifiers Critical 9.3
• CVE-2026-23518 Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment Critical 9.3
• CVE-2026-26062 Fleet server may terminate unexpectedly when handling certain gRPC requests High 8.7
• CVE-2026-26061 Fleet's unbounded request body read allows remote Denial of Service High 8.7
• CVE-2026-23998 Fleet has a Windows MDM management endpoint authentication bypass High 8.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w3wf-cfx3-6gcx.