Product
Fleet Server gRPC PublishLogs Endpoint Denial-of-Service Vulnerability (CVE-2026-26062)
2 rules 1 TTP 1 IOCFleet server versions prior to 4.81.0 are vulnerable to a denial-of-service (DoS) via the gRPC Launcher `PublishLogs` endpoint, where unexpected input values can cause the server process to terminate upon receiving a crafted request from an authenticated Launcher host.
Fleet Windows MDM Management Endpoint Authentication Bypass Vulnerability
2 rules 2 TTPs 1 IOCCVE-2026-23998 describes a vulnerability in Fleet's Windows MDM management endpoint that allows requests to be processed without proper client certificate validation, potentially allowing an attacker to impersonate a device and retrieve sensitive configuration data.
Rancher Fleet Helm Impersonation Bypass Vulnerability
2 rules 1 TTPFleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their `GitRepo`.