CVE-2026-41262: Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint

June 26, 2026

The global policy read endpoint (GET /api/latest/fleet/policies/{policy_id}) performs authorization against an empty fleet.Policy{} struct with nil TeamID, then fetches any policy by ID from the database without verifying the fetched policy actually belongs to the global scope. This allows a user with observer-level access on any single team to read the full details of policies belonging to any other team, bypassing Fleet’s team isolation model.

References

github.com/advisories/GHSA-gm7f-v959-fr2g
github.com/fleetdm/fleet/security/advisories/GHSA-gm7f-v959-fr2g
nvd.nist.gov/vuln/detail/CVE-2026-41262

Code Behaviors & Features

Detect and mitigate CVE-2026-41262 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →