CVE-2026-29180 Fleet's team maintainer can transfer hosts from any team via missing source team authorization

What is CVE-2026-29180?

CVE-2026-29180 is a medium-severity missing authorization vulnerability in fleetdm fleet, published on 27 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Fleet is open source device management software. Prior to 4.81.1, a broken access control vulnerability in Fleet's host transfer API allows a team maintainer to transfer hosts from any team into their own team, bypassing team isolation boundaries. Once transferred, the attacker gains full control over the stolen hosts, including the ability to execute scripts with root privileges. Version 4.81.1 patches the issue.

Weakness: CWE-862

Which versions are affected by CVE-2026-29180?

3 open source packages ship an affected version, including github.com/fleetdm/fleet/v4. It affects 1 product.

Products include Fleetdm Fleet.

How do I fix CVE-2026-29180?

Upgrade github.com/fleetdm/fleet/v4 to 4.81.1 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-29180 being exploited?

There is no known exploitation of CVE-2026-29180 in the wild and no public exploit code.

Other vulnerabilities in fleetdm fleet

• CVE-2020-26276 SAML authentication vulnerability in Fleet Critical 10.0
• CVE-2026-103264 Fleet before 4.87.0 Authentication Bypass via Device Identifiers Critical 9.3
• CVE-2026-23518 Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment Critical 9.3
• CVE-2026-26062 Fleet server may terminate unexpectedly when handling certain gRPC requests High 8.7
• CVE-2026-26061 Fleet's unbounded request body read allows remote Denial of Service High 8.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m2h6-4xpq-qw3m, GO-2026-4892.