Fleetの招待によるユーザーアカウント作成時に、github.com/fleetdm/fleetで招待されたメールアドレスの検証が行われない

The primary impact of CVE-2026-34389 is the potential for unauthorized account creation. An attacker can craft a malicious invitation link using a spoofed email address, bypassing the intended email verification process. Successful exploitation allows the attacker to create a new user account within the Fleet system, effectively gaining access to resources and data controlled by that account. This could lead to data breaches, system compromise, and further lateral movement within the environment. The blast radius depends on the privileges associated with the newly created account.

Organizations utilizing fleetdm/fleet/v4, particularly those relying on email invitations for user onboarding, are at risk. Shared hosting environments where multiple users share a Fleet instance are also potentially vulnerable, as an attacker could exploit this to create accounts for other users.

1. 2026-04-02Disclosure

   disclosure

1. 予約済み2026-03-27
2. 公開日2026-04-02
3. EPSS 更新日2026-04-04

The recommended mitigation for CVE-2026-34389 is to immediately upgrade Fleet to version 4.81.0 or later, which includes the fix for this vulnerability. If upgrading is not immediately feasible, consider implementing stricter email verification policies within Fleet, if possible. Review existing user accounts for any suspicious activity and consider temporarily disabling the user invitation feature until the upgrade can be completed. After upgrading, confirm the fix by attempting to create a user account with a deliberately spoofed email address; the invitation should fail.