Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.0
CVE-2026-26191: Fleet software installer vulnerable to malicious package execution
GHSA-9vcr-g537-3w5v
CVE-2026-26191
GHSA-9vcr-g537-3w5v
Summary
Fleet's software installer pipeline is affected, which could allow a malicious software package to run arbitrary commands on managed endpoints. This is a risk because a hacker could upload a package that executes commands without your knowledge. To protect yourself, avoid uploading software packages from untrusted sources and manually inspect uninstall scripts before deployment, or upgrade to the latest version if possible.
What to do
- Update github.com fleetdm to version 4.81.1.
- Update fleetdm github.com/fleetdm/fleet/v4 to version 4.81.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | fleetdm |
< 4.81.1 Fix: upgrade to 4.81.1
|
| Go | fleetdm | github.com/fleetdm/fleet/v4 |
< 4.81.1 Fix: upgrade to 4.81.1
|
| – | fleetdm | fleet |
< 4.81.0 cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:* |
Original title
Fleet vulnerable to OS command injection in software packages
Original description
### Summary
A vulnerability in Fleet's software installer pipeline could allow a crafted software package to execute arbitrary commands as root (macOS/Linux) or SYSTEM (Windows) on managed endpoints when an uninstall is triggered.
### Impact
When a software package (.pkg, .deb, .rpm, .exe, or .msi) is uploaded to Fleet, metadata is extracted from the package binary and used to generate uninstall scripts. In affected versions, this metadata is not properly sanitized before being included in the generated scripts. A specially crafted package containing malicious values in its metadata fields could result in unintended command execution when the uninstall script runs on managed endpoints.
### Workarounds
If an immediate upgrade is not possible, administrators should avoid uploading software packages obtained from untrusted or unverified sources. Additionally, administrators can manually inspect and edit auto-generated uninstall scripts before deployment.
### For more information
If you have any questions or comments about this advisory:
Email us at [[[email protected]](mailto:[email protected])](mailto:[email protected])
Join #fleet in [[osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)
### Credits
We thank @secfox-ai for responsibly reporting this issue.
A vulnerability in Fleet's software installer pipeline could allow a crafted software package to execute arbitrary commands as root (macOS/Linux) or SYSTEM (Windows) on managed endpoints when an uninstall is triggered.
### Impact
When a software package (.pkg, .deb, .rpm, .exe, or .msi) is uploaded to Fleet, metadata is extracted from the package binary and used to generate uninstall scripts. In affected versions, this metadata is not properly sanitized before being included in the generated scripts. A specially crafted package containing malicious values in its metadata fields could result in unintended command execution when the uninstall script runs on managed endpoints.
### Workarounds
If an immediate upgrade is not possible, administrators should avoid uploading software packages obtained from untrusted or unverified sources. Additionally, administrators can manually inspect and edit auto-generated uninstall scripts before deployment.
### For more information
If you have any questions or comments about this advisory:
Email us at [[[email protected]](mailto:[email protected])](mailto:[email protected])
Join #fleet in [[osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)
### Credits
We thank @secfox-ai for responsibly reporting this issue.
ghsa CVSS4.0
6.0
Vulnerability type
CWE-78
OS Command Injection
Published: 14 May 2026 · Updated: 28 May 2026 · First seen: 14 May 2026