CVE-2026-22808: Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability

January 20, 2026 (updated January 22, 2026)

A cross-site scripting (XSS) vulnerability in Fleet’s Windows MDM authentication flow could allow an attacker to compromise a Fleet user account. In certain cases, this could lead to administrative access and the ability to perform privileged actions on managed devices.

References

github.com/advisories/GHSA-gfpw-jgvr-cw4j
github.com/fleetdm/fleet
github.com/fleetdm/fleet/commit/0e6c790803d1b4407c5b4b41a67a37864a3d3573
github.com/fleetdm/fleet/security/advisories/GHSA-gfpw-jgvr-cw4j
nvd.nist.gov/vuln/detail/CVE-2026-22808

Code Behaviors & Features

Detect and mitigate CVE-2026-22808 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →