CVE-2026-29180

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Fleet is open source device management software. Prior to 4.81.1, a broken access control vulnerability in Fleet's host transfer API allows a team maintainer to transfer hosts from any team into their own team, bypassing team isolation boundaries. Once transferred, the attacker gains full control over the stolen hosts, including the ability to execute scripts with root privileges. Version 4.81.1 patches the issue.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Mar 27, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-291817.5OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header CVE-2026-291827.2Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.4 and 9.4.1-al CVE-2026-291836.1SiYuan is a personal knowledge management system. Prior to version 3.5.9, an unauthenticated reflected XSS vulnerability exists in the dynam CVE-2026-291846.5Backstage is an open framework for building developer portals. Prior to version 3.1.4, a malicious scaffolder template can bypass the log re CVE-2026-291852.7Backstage is an open framework for building developer portals. Prior to version 1.20.1, a vulnerability in the SCM URL parsing used by Backs CVE-2026-291869.8Backstage is an open framework for building developer portals. Prior to version 1.14.3, this is a configuration bypass vulnerability that en CVE-2026-291878.8OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, a Blind S CVE-2026-291888.1File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit CVE-2026-291898.1SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3 CVE-2026-29194.3Malicious scripts could display attacker-controlled web content under spoofed domains in Focus for iOS by stalling a _self navigation to an CVE-2026-291905.3Karapace is an open-source implementation of Kafka REST and Schema Registry. Prior to version 6.0.0, there is a Path Traversal vulnerability CVE-2026-291919.3ZITADEL is an open source identity management platform. From version 4.0.0 to 4.11.1, a vulnerability in Zitadel's login V2 interface was di