Threats affecting pkg:golang/fleet

Fleet before 4.86.2 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory through quadratic XML canonicalization of unsigned SAML responses. Attackers can send a single crafted SAML response with deeply nested elements declaring new namespace prefixes to POST /api/v1/fleet/sso/callback, crashing the Fleet server.

Fleet versions prior to 4.89.0 have an authorization vulnerability in the user administration API. Authenticated team administrators can create or modify users with administrator roles on teams they do not fully control. This flaw allows privilege escalation across teams, enabling deployment of software and execution of scripts on hosts managed by other teams.

Fleet versions before 4.83.0 have a denial of service vulnerability due to improper handling of gzip-compressed request bodies. Unauthenticated attackers can send small, highly compressed requests to unauthenticated endpoints, which expand during decompression and exhaust server memory, causing the Fleet instance to crash.

Fleet versions prior to 4.89.0 have an unbounded recursion vulnerability in the Apple MDM enrollment property list parsing. This flaw allows unauthenticated attackers to send a crafted binary plist payload that triggers exponential resource consumption, causing the server to crash. The vulnerability can be exploited by sending a payload of about 150 bytes to the enrollment endpoints, leading to CPU and memory exhaustion.