CVE-2026-34387: Fleet vulnerable to OS command injection via crafted software package metadata in uninstall scripts

Q: What is the severity of CVE-2026-34387?

CVE-2026-34387 has been classified as a critical vulnerability due to its ability to allow arbitrary code execution.

Q: How do I fix CVE-2026-34387?

To mitigate CVE-2026-34387, upgrade Fleet to version 4.81.1 or later.

Q: What type of vulnerability is CVE-2026-34387?

CVE-2026-34387 is identified as an OS command injection vulnerability.

Q: What could an attacker achieve by exploiting CVE-2026-34387?

An attacker exploiting CVE-2026-34387 could achieve arbitrary code execution as root.

Q: Which versions of Fleet are affected by CVE-2026-34387?

Versions of Fleet prior to 4.81.1 are affected by CVE-2026-34387.

Published Mar 27, 2026

Updated

Fleet is open source device management software. Prior to 4.81.1, a command injection vulnerability in Fleet's software installer pipeline allows an attacker to achieve arbitrary code execution as root (macOS/Linux) or SYSTEM (Windows) on managed hosts when an uninstall is triggered for a crafted software package. Version 4.81.1 patches the issue.

Affected Software

2 affected components

fleetdm fleet<4.81.1

Event History

Mar 27, 2026

CVE Published

via MITRE·06:31 PM

Data Sourced

via MITRE·06:31 PM

DescriptionWeakness

Data Sourced

via NVD·07:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-34387?

CVE-2026-34387 has been classified as a critical vulnerability due to its ability to allow arbitrary code execution.

How do I fix CVE-2026-34387?

To mitigate CVE-2026-34387, upgrade Fleet to version 4.81.1 or later.

What type of vulnerability is CVE-2026-34387?