CVE-2026-27465
CVE-2026-27465 is a medium-severity vulnerability in Fleetdm Fleet with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-201.
Key facts
- Severity: Medium (CVSS 3.x base score 6.5)
- CVSS v4: 1.3
- EPSS exploit prediction: 0% (15th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-8829
- Weakness: CWE-201
- Affected product: Fleetdm Fleet
- Published:
- Last modified:
Description
Fleet is open source device management software. In versions prior to 4.80.1, a vulnerability in Fleet’s configuration API could expose Google Calendar service account credentials to authenticated users with low-privilege roles. This may allow unauthorized access to Google Calendar resources associated with the service account. Fleet returns configuration data through an API endpoint that is accessible to authenticated users, including those with the lowest-privilege “Observer” role. In affected versions, Google Calendar service account credentials were not properly obfuscated before being returned. As a result, a low-privilege user could retrieve the service account’s private key material. Depending on how the Google Calendar integration is configured, this could allow unauthorized access to calendar data or other Google Workspace resources associated with the service account. This issue does not allow escalation of privileges within Fleet or access to device management functionality. Version 4.80.1 patches the issue. If an immediate upgrade is not possible, administrators should remove the Google Calendar integration from Fleet and rotate the affected Google service account credentials.
Frequently asked questions
- What is CVE-2026-27465?
- Fleet is open source device management software. In versions prior to 4.80.1, a vulnerability in Fleet’s configuration API could expose Google Calendar service account credentials to authenticated users with low-privilege roles. This may allow unauthorized access to Google Calendar resources associated with the service account. Fleet returns configuration data through an API endpoint that is accessible to authenticated users, including those with the lowest-privilege “Observer” role. In affected versions, Google Calendar service account credentials were not properly obfuscated before being returned. As a result, a low-privilege user could retrieve the service account’s private key material. Depending on how the Google Calendar integration is configured, this could allow unauthorized access to calendar data or other Google Workspace resources associated with the service account. This issue does not allow escalation of privileges within Fleet or access to device management functionality. Version 4.80.1 patches the issue. If an immediate upgrade is not possible, administrators should remove the Google Calendar integration from Fleet and rotate the affected Google service account credentials.
- How severe is CVE-2026-27465?
- CVE-2026-27465 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
- Is CVE-2026-27465 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-27465?
- CVE-2026-27465 affects Fleetdm Fleet. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-27465?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2026-27465 have an EU (EUVD) identifier?
- Yes. CVE-2026-27465 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-8829.
- When was CVE-2026-27465 published?
- CVE-2026-27465 was published on 2026-02-26 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*
More vulnerabilities in Fleetdm Fleet
- CVE-2020-26276 — Critical (CVSS 10.0): Fleet is an open source osquery manager. In Fleet before version 3.5.1, due to issues in Go's standard library XML…
- CVE-2026-26191 — Critical (CVSS 9.8): Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet's software installer…
- CVE-2026-34387 — Critical (CVSS 9.8): Fleet is open source device management software. Prior to 4.81.1, a command injection vulnerability in Fleet's software…
- CVE-2026-23518 — Critical (CVSS 9.8): Fleet is open source device management software. In versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3, a…
- CVE-2026-34386 — High (CVSS 8.8): Fleet is open source device management software. Prior to 4.81.0, a SQL injection vulnerability in Fleet's MDM…
- CVE-2026-29180 — High (CVSS 8.8): Fleet is open source device management software. Prior to 4.81.1, a broken access control vulnerability in Fleet's host…
All CVEs affecting Fleetdm Fleet →
Other CWE-201 vulnerabilities
- CVE-2025-49408 — Critical (CVSS 10.0): Insertion of Sensitive Information Into Sent Data vulnerability in WPDeveloper Templately allows Retrieve Embedded…
- CVE-2024-7205 — Critical (CVSS 9.4): When the device is shared, the homepage module are before 2.19.0 in eWeLink Cloud Service allows Secondary user to…
- CVE-2026-39912 — Critical (CVSS 9.1): V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP response bodies of the…
- CVE-2025-48749 — Critical (CVSS 9.1): Netwrix Directory Manager (formerly Imanami GroupID) v11.0.0.0 and before & after v.11.1.25134.03 inserts Sensitive…
- CVE-2025-11500 — High (CVSS 8.7): Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 have two separate authentication…
- CVE-2025-48045 — High (CVSS 8.7): An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user…