Fleet MDM Vulnerability: SQL Injection Threatens Sensitive Data

CVE Notify is flagging a critical second-order SQL injection vulnerability (CVE-2026-34385) impacting Fleet, the open-source device management software. They report that prior to version 4.81.0, an attacker possessing a valid MDM enrollment certificate could exploit this flaw. The vulnerability resides within Fleet’s Apple MDM profile delivery pipeline. Exploitation could lead to the exfiltration or modification of the Fleet database contents, a serious risk given the sensitive information it likely stores.

According to CVE Notify, the compromised data could include user credentials, API tokens, and crucial device enrollment secrets. This means a successful attack could grant an adversary deep access into an organization’s device management infrastructure, potentially enabling further lateral movement and compromise. Fleet has since patched this vulnerability in version 4.81.0, making an immediate upgrade a top priority for all users.