CVE-2026-23517

Description

Fleet has an Access Control vulnerability in debug/pprof endpoints in github.com/fleetdm/fleet

How to fix CVE-2026-23517

To remediate CVE-2026-23517, upgrade the affected package to a fixed version below.

• Go/github.com/fleetdm/fleet—upgrade to 4.78.3 or later
• Go/github.com/fleetdm/fleet/v4—upgrade to 4.78.3-0.20260112221730-5c030e32a3a9 or later
• Go/github.com/fleetdm/fleet/v4—upgrade to 4.75.2 or later

Is CVE-2026-23517 being exploited?

Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.

Affected packages (3)

• >= 4.78.0, < 4.78.3
• from 0, < 4.78.3-0.20260112221730-5c030e32a3a9
• >= 4.75.0, < 4.75.2, >= 4.76.0, < 4.76.2, >= 4.77.0, < 4.77.1, >= 4.78.0, < 4.78.3

CVSS scores

References (5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-23517
• PATCHgithub.com/fleetdm/fleet
• WEBgithub.com/fleetdm/fleet/commit/5c030e32a3a9bc512355b5e1bf19636e4e6d0317
• WEBgithub.com/fleetdm/fleet/security/advisories/GHSA-4r5r-ccr6-q6f6
• WEB