CVE-2026-34391 Fleet Vulnerable to Windows MDM cross-device command disclosure
A malicious enrolled device can access MDM commands intended for other devices, exposing sensitive configuration data like WiFi credentials and VPN secrets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-34391?
CVE-2026-34391 is a medium-severity vulnerability in fleetdm fleet, published on 27 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Fleet is open source device management software. Prior to 4.81.1, a vulnerability in Fleet's Windows MDM command processing allows a malicious enrolled device to access MDM commands intended for other devices, potentially exposing sensitive configuration data such as WiFi credentials, VPN secrets, and certificate payloads across the entire Windows fleet. Version 4.81.1 patches the issue.
Weakness: CWE-488
Which versions are affected by CVE-2026-34391?
It affects 1 product.
Products include Fleetdm Fleet.
How do I fix CVE-2026-34391?
No fix has been published for CVE-2026-34391 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-34391 being exploited?
There is no known exploitation of CVE-2026-34391 in the wild and no public exploit code.
Other vulnerabilities in fleetdm fleet
- CVE-2020-26276 SAML authentication vulnerability in Fleet
- CVE-2026-103264 Fleet before 4.87.0 Authentication Bypass via Device Identifiers
- CVE-2026-23518 Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment
- CVE-2026-26062 Fleet server may terminate unexpectedly when handling certain gRPC requests
- CVE-2026-26061 Fleet's unbounded request body read allows remote Denial of Service
Sources
Also known as GHSA-wg7j-pcc3-h4rh.