{"cve":"CVE-2026-22808","nvd":{"published":"2026-01-21T22:15:49.233","modified":"2026-06-17T10:20:28.007","status":"Analyzed","description":"fleetdm/fleet is open source device management software. Prior to versions 4.78.2, 4.77.1, 4.76.2, 4.75.2, and 4.53.3, if Windows MDM is enabled, an unauthenticated attacker can exploit this XSS vulnerability to steal a Fleet administrator's authentication token (FLEET::auth_token) from localStorage. This could allow unauthorized access to Fleet, including administrative access, visibility into device data, and modification of configuration. Versions 4.78.2, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 fix the issue. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H","score":5.5},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","score":5.4},"cwes":["CWE-79"],"references":["https://github.com/fleetdm/fleet/security/advisories/GHSA-gfpw-jgvr-cw4j"],"products":["fleetdm:fleet"],"source":"nvd","synced_at":"2026-10-19T22:21:16.563232421+00:00"},"epss":{"cve":"CVE-2026-22808","score":0.00249,"percentile":0.16245,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-gfpw-jgvr-cw4j","url":"https://osv.dev/vulnerability/GHSA-gfpw-jgvr-cw4j","summary":"Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability","modified":"2026-02-03T22:41:17.423857Z","packages":[{"ecosystem":"Go","name":"github.com/fleetdm/fleet","purl":"pkg:golang/github.com/fleetdm/fleet","ranges":[">=4.78.0 <4.78.2"],"fixed":["4.78.2"]},{"ecosystem":"Go","name":"github.com/fleetdm/fleet","purl":"pkg:golang/github.com/fleetdm/fleet","ranges":[">=4.77.0 <4.77.1"],"fixed":["4.77.1"]},{"ecosystem":"Go","name":"github.com/fleetdm/fleet","purl":"pkg:golang/github.com/fleetdm/fleet","ranges":[">=4.76.0 <4.76.2"],"fixed":["4.76.2"]},{"ecosystem":"Go","name":"github.com/fleetdm/fleet","purl":"pkg:golang/github.com/fleetdm/fleet","ranges":[">=4.75.0 <4.75.2"],"fixed":["4.75.2"]},{"ecosystem":"Go","name":"github.com/fleetdm/fleet/v4","purl":"pkg:golang/github.com/fleetdm/fleet/v4","ranges":["<4.43.5-0.20260111020427-0e6c790803d1"],"fixed":["4.43.5-0.20260111020427-0e6c790803d1"]}]},{"id":"GO-2026-4336","url":"https://osv.dev/vulnerability/GO-2026-4336","summary":"Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability in github.com/fleetdm/fleet","modified":"2026-02-03T22:41:17.423857Z","packages":[{"ecosystem":"Go","name":"github.com/fleetdm/fleet/v4","purl":"pkg:golang/github.com/fleetdm/fleet/v4","ranges":[">=4.75.0 <4.75.2",">=4.76.0 <4.76.2",">=4.77.0 <4.77.1",">=4.78.0 <4.78.2"],"fixed":["4.75.2","4.76.2","4.77.1","4.78.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}