CVE-2026-22808

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-22808
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22808.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-22808
Aliases
Published
2026-01-21T21:18:26.283Z
Modified
2026-01-22T19:49:53.706601Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H CVSS Calculator
Summary
Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability
Details

fleetdm/fleet is open source device management software. Prior to versions 4.78.2, 4.77.1, 4.76.2, 4.75.2, and 4.53.3, if Windows MDM is enabled, an unauthenticated attacker can exploit this XSS vulnerability to steal a Fleet administrator's authentication token (FLEET::auth_token) from localStorage. This could allow unauthorized access to Fleet, including administrative access, visibility into device data, and modification of configuration. Versions 4.78.2, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 fix the issue. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22808.json"
}
References

Affected packages

Git / github.com/fleetdm/fleet

Affected ranges

Type
GIT
Repo
https://github.com/fleetdm/fleet
Events
Introduced
7d1535fec3c7e328bb92840f4c7cb0e9102d062f
Fixed
9c51cd86d537c80645355d012210958767cf2235
Database specific 
{
    "versions": [
        {
            "introduced": "4.78.0"
        },
        {
            "fixed": "4.78.2"
        }
    ]
}
Type
GIT
Repo
https://github.com/fleetdm/fleet
Events
Introduced
31f5d1edcc1fdb09fa8f2e541aa53eb077a593c8
Fixed
ba894ff34e55c56a8afccbbf0c412a4a631382f7
Database specific 
{
    "versions": [
        {
            "introduced": "4.77.0"
        },
        {
            "fixed": "4.77.1"
        }
    ]
}
Type
GIT
Repo
https://github.com/fleetdm/fleet
Events
Introduced
e1ac2df3ddd0567ae18b872641f849566e982008
Fixed
8c1e446f9f9658f01adbf2d2c5c4d86caaa5cf91
Database specific 
{
    "versions": [
        {
            "introduced": "4.76.0"
        },
        {
            "fixed": "4.76.2"
        }
    ]
}

Affected versions

fleet-v4.*

fleet-v4.76.0
fleet-v4.76.1
fleet-v4.77.0
fleet-v4.78.0
fleet-v4.78.1

v4.*

v4.76.0
v4.77.0
v4.78.0
v4.78.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22808.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "4.53.3"
            }
        ]
    }
]