GHSA-4r5r-ccr6-q6f6
Fleet has an Access Control vulnerability in debug/pprof endpoints
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/fleetdm/fleet | >= 4.78.0, < 4.78.3 | 4.78.3 |
| Go | github.com/fleetdm/fleet | >= 4.77.0, < 4.77.1 | 4.77.1 |
| Go | github.com/fleetdm/fleet | >= 4.76.0, < 4.76.2 | 4.76.2 |
| Go | github.com/fleetdm/fleet | >= 4.75.0, < 4.75.2 | 4.75.2 |
| Go | github.com/fleetdm/fleet/v4 | < 4.78.3-0.20260112221730-5c030e32a3a9 | 4.78.3-0.20260112221730-5c030e32a3a9 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Summary
A broken access control issue in Fleet allowed authenticated users to access debug and profiling endpoints regardless of role. As a result, low-privilege users could view internal server diagnostics and trigger resource-intensive profiling operations.
### Impact
Fleet’s debug/pprof endpoints are accessible to any authenticated user regardless of role, including the lowest-privilege “Observer” role. This allows low-privilege users to access sensitive server internals, including runtime profiling data and in-memory application state, and to trigger CPU-intensive profiling operations that could lead to denial of service.
### Patches
- 4.78.3
- 4.77.1
- 4.76.2
- 4.75.2
- 4.53.3
### Workarounds
If an immediate upgrade is not possible, users should put the debug/pprof endpoints behind an IP allowlist.
### For more information
If you have any questions or comments about this advisory:
Email us at [[email protected]](mailto:[email protected])
Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)
### Credits
We thank @secfox-ai for responsibly reporting this issue.
References
External links from the advisory. They lead to third-party sites.