CVE-2020-26276

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Fleet is an open source osquery manager. In Fleet before version 3.5.1, due to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from a SAML IdP. Users that configure Fleet with SSO login may be vulnerable to this issue. This issue is patched in 3.5.1. The fix was made using https://github.com/mattermost/xml-roundtrip-validator If upgrade to 3.5.1 is not possible, users should disable SSO authentication in Fleet.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-290

Affected software

Vendor	Product	Versions
fleetdm	fleet	< 3.5.1

References

https://github.com/fleetdm/fleet/blob/master/CHANGELOG.md#fleet-351-dec-14-2020Release Notes, Third Party Advisory
https://github.com/fleetdm/fleet/commit/57812a532e5f749c8e18c6f6a652eca65c083607Patch, Third Party Advisory
https://github.com/fleetdm/fleet/security/advisories/GHSA-w3wf-cfx3-6gcxThird Party Advisory
https://github.com/mattermost/xml-roundtrip-validatorThird Party Advisory
https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilitiesNot Applicable, Third Party Advisory
https://github.com/fleetdm/fleet/blob/master/CHANGELOG.md#fleet-351-dec-14-2020Release Notes, Third Party Advisory
https://github.com/fleetdm/fleet/commit/57812a532e5f749c8e18c6f6a652eca65c083607Patch, Third Party Advisory
https://github.com/fleetdm/fleet/security/advisories/GHSA-w3wf-cfx3-6gcxThird Party Advisory
https://github.com/mattermost/xml-roundtrip-validatorThird Party Advisory
https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilitiesNot Applicable, Third Party Advisory

Timeline

Published: Dec 17, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-262776.1DBdeployer is a tool that deploys MySQL database servers easily. In DBdeployer before version 1.58.2, users unpacking a tarball may use a ma CVE-2020-262788.0Weave Net is open source software which creates a virtual network that connects Docker containers across multiple hosts and enables their au CVE-2020-262798.1go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8 CVE-2020-26286.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Host Management). Supported versions CVE-2020-262808.9OpenSlides is a free, Web-based presentation and assembly system for managing and projecting agenda, motions, and elections of assemblies. O CVE-2020-262817.5async-h1 is an asynchronous HTTP/1.1 parser for Rust (crates.io). There is a request smuggling vulnerability in async-h1 before version 2.3.CVE-2020-2628210.0BrowserUp Proxy allows you to manipulate HTTP requests and responses, capture HTTP content, and export performance data as a HAR file. Brows CVE-2020-262838.8go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8 CVE-2020-262848.5Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's `os/exec` for certain features, e.g. for rendering of Pa CVE-2020-262857.2OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, there is a vulnerability which ena CVE-2020-262867.5HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an unauthenticated attacker can uplo CVE-2020-262878.7HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an attacker can inject arbitrary `sc