CVE-2026-126401

CVSS 8.7 (high) · published 2026-11-13

Fleet before 4.86.2 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory through quadratic XML canonicalization of unsigned SAML responses. Attackers can send a single crafted SAML response with deeply nested elements declaring new namespace prefixes to POST /api/v1/fleet/sso/callback, crashing the Fleet server.

Weakness: CWE-407

Source: NVD CVE-2026-126401

References

• https://github.com/fleetdm/fleet/security/advisories/GHSA-mjrh-3v6h-8g5p
• https://www.vulncheck.com/advisories/fleet-before-4.86.2-unauthenticated-dos-via-sso-callback-xml-canonicalization

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.