CVE-2026-34385 is a second-order SQL injection vulnerability in Fleet's Apple MDM profile delivery pipeline present in versions before 4.81.0. An attacker possessing a valid MDM enrollment certificate can exploit this flaw to execute unauthorized SQL commands, potentially leading to exfiltration or modification of the Fleet database, which contains critical information like user credentials, API tokens, and device enrollment secrets. The vulnerability is addressed by an official patch in Fleet version 4.81.0.

Successful exploitation allows an attacker with limited privileges (valid MDM enrollment certificate) to perform SQL injection attacks that can compromise the confidentiality and integrity of the Fleet database. This includes unauthorized access to sensitive credentials and secrets, which could lead to further compromise of managed devices or the Fleet environment. No known exploits in the wild have been reported.

Upgrade Fleet to version 4.81.0 or later, where this vulnerability is patched. Since this is an official fix, applying the update fully mitigates the risk. No additional vendor advisories indicate alternative mitigations or that no action is required.