CVE-2026-34387 Fleet vulnerable to OS command injection via crafted software package metadata in uninstall scripts
Attackers can execute arbitrary code as root or SYSTEM on managed hosts via crafted software package metadata in uninstall scripts.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-34387?
CVE-2026-34387 is a medium-severity command injection vulnerability in fleetdm fleet, published on 27 Mar 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Fleet is open source device management software. Prior to 4.81.1, a command injection vulnerability in Fleet's software installer pipeline allows an attacker to achieve arbitrary code execution as root (macOS/Linux) or SYSTEM (Windows) on managed hosts when an uninstall is triggered for a crafted software package. Version 4.81.1 patches the issue.
Weakness: CWE-78
Which versions are affected by CVE-2026-34387?
It affects 1 product.
Products include Fleetdm Fleet.
How do I fix CVE-2026-34387?
No fix has been published for CVE-2026-34387 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-34387 being exploited?
There is no known exploitation of CVE-2026-34387 in the wild and no public exploit code.
Other vulnerabilities in fleetdm fleet
- CVE-2020-26276 SAML authentication vulnerability in Fleet
- CVE-2026-103264 Fleet before 4.87.0 Authentication Bypass via Device Identifiers
- CVE-2026-23518 Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment
- CVE-2026-26062 Fleet server may terminate unexpectedly when handling certain gRPC requests
- CVE-2026-26061 Fleet's unbounded request body read allows remote Denial of Service
Sources
Also known as GHSA-7rhw-5mpv-gp4h.