CVE-2020-26276

    Dashboard / Vulnerabilities / CVE-2020-26276

    CVE-2020-26276

    Published: 17 Dec 2020Last Modified: 9 Jul 2026

    Summary:

    Details: Fleet is an open source osquery manager. In Fleet before version 3.5.1, due to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from a SAML IdP. Users that configure Fleet with SSO login may be vulnerable to this issue. This issue is patched in 3.5.1. The fix was made using https://github.com/mattermost/xml-roundtrip-validator If upgrade to 3.5.1 is not possible, users should disable SSO authentication in Fleet.

    References: https://github.com/fleetdm/fleet/blob/master/CHANGELOG.md#fleet-351-dec-14-2020, https://github.com/fleetdm/fleet/security/advisories/GHSA-w3wf-cfx3-6gcx, https://github.com/mattermost/xml-roundtrip-validator, https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities, https://github.com/fleetdm/fleet/commit/57812a532e5f749c8e18c6f6a652eca65c083607

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -55a2aa2c955a99483b730e60207e4afada7bda8a

    Affected versions

    3.5.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2020-26276 | CVE-DB