CVE-2026-22808 Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability
An unauthenticated attacker can steal admin tokens via XSS in the Windows MDM endpoint, gaining unauthorized access and control over Fleet.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-22808?
CVE-2026-22808 is a medium-severity cross-site scripting vulnerability in fleetdm fleet, published on 21 Jan 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
fleetdm/fleet is open source device management software. Prior to versions 4.78.2, 4.77.1, 4.76.2, 4.75.2, and 4.53.3, if Windows MDM is enabled, an unauthenticated attacker can exploit this XSS vulnerability to steal a Fleet administrator's authentication token (FLEET::auth_token) from localStorage. This could allow unauthorized access to Fleet, including administrative access, visibility into device data, and modification of configuration. Versions 4.78.2, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 fix the issue. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.
Weakness: CWE-79
Which versions are affected by CVE-2026-22808?
11 open source packages ship an affected version, including github.com/fleetdm/fleet and github.com/fleetdm/fleet/v4. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/fleetdm/fleet Go | From 4.75.0 | 4.75.2 |
github.com/fleetdm/fleet Go | From 4.75.0 | 4.75.2 |
github.com/fleetdm/fleet Go | From 4.76.0 | 4.76.2 |
github.com/fleetdm/fleet Go | From 4.76.0 | 4.76.2 |
github.com/fleetdm/fleet Go | From 4.77.0 | 4.77.1 |
github.com/fleetdm/fleet Go | From 4.77.0 | 4.77.1 |
5 more packages
github.com/fleetdm/fleet Go | From 4.78.0 | 4.78.2 |
github.com/fleetdm/fleet Go | From 4.78.0 | 4.78.2 |
github.com/fleetdm/fleet/v4 Go | All versions | 4.43.5-0.20260111020427-0e6c790803d1 |
github.com/fleetdm/fleet/v4 Go | All versions | 4.43.5-0.20260111020427-0e6c790803d1 |
github.com/fleetdm/fleet/v4 Go | From 4.75.0 | 4.75.2, 4.76.2, 4.77.1, 4.78.2 |
Products include Fleetdm Fleet.
How do I fix CVE-2026-22808?
Upgrade github.com/fleetdm/fleet to a fixed version for your release line: 4.75.2, 4.76.2, 4.77.1 or 4.78.2.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-22808 being exploited?
There is no known exploitation of CVE-2026-22808 in the wild and no public exploit code.
Other vulnerabilities in fleetdm fleet
- CVE-2020-26276 SAML authentication vulnerability in Fleet
- CVE-2026-103264 Fleet before 4.87.0 Authentication Bypass via Device Identifiers
- CVE-2026-23518 Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment
- CVE-2026-26062 Fleet server may terminate unexpectedly when handling certain gRPC requests
- CVE-2026-26061 Fleet's unbounded request body read allows remote Denial of Service
Sources
Also known as GHSA-gfpw-jgvr-cw4j, GO-2026-4336.