CVE-2026-126401: Fleet before 4.86.2 Unauthenticated DoS via SSO Callback XML Canonicalization
Fleet before 4.86.2 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory through quadratic XML canonicalization of unsigned SAML responses. Attackers can send a single crafted SAML response with deeply nested elements declaring new namespace prefixes to POST /api/v1/fleet/sso/callback, crashing the Fleet server.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.86.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Fleet versions before 4.86.2 are affected. The vulnerable endpoint is the SSO callback at /api/v1/fleet/sso/callback.
Does an attacker need credentials or user interaction?
No. The issue is unauthenticated and can be triggered remotely without user interaction by posting a crafted SAML response to the callback endpoint.
What must an attacker send to cause the denial of service?
The attacker needs a single crafted, unsigned SAML response containing deeply nested elements that declare new namespace prefixes. Processing this input causes quadratic XML canonicalization and can exhaust server memory.
How can this be remediated?
Upgrade Fleet to version 4.86.2 or later.