CVE-2026-23517: Fleet has an Access Control vulnerability in debug/pprof endpoints

January 20, 2026 (updated February 27, 2026)

A broken access control issue in Fleet allowed authenticated users to access debug and profiling endpoints regardless of role. As a result, low-privilege users could view internal server diagnostics and trigger resource-intensive profiling operations.

References

github.com/advisories/GHSA-4r5r-ccr6-q6f6
github.com/fleetdm/fleet
github.com/fleetdm/fleet/commit/5c030e32a3a9bc512355b5e1bf19636e4e6d0317
github.com/fleetdm/fleet/security/advisories/GHSA-4r5r-ccr6-q6f6
nvd.nist.gov/vuln/detail/CVE-2026-23517
pkg.go.dev/vuln/GO-2026-4334

Code Behaviors & Features

Detect and mitigate CVE-2026-23517 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →