CVE-2026-26191 is a critical command injection flaw (CVSS 9.8) in Fleet, the open source device management software. Metadata from an uploaded software package can be put into uninstall scripts and run as root or SYSTEM on managed endpoints. Upgrade to 4.81.1. The record does not list it in CISA's KEV catalog, and the sources we read do not report exploitation.
What's affected
- Fleet before 4.81.1, per the GitHub advisory
- The NVD description says 4.81.0 contains a patch and links the 4.81.1 release, so the advisory's number is the safer target
- Fixed in 4.81.1 and later
Package types named: pkg, deb, rpm, exe and msi. The advisory lists two workarounds for those who cannot upgrade: avoid uploading packages from untrusted or unverified sources, and manually inspect and edit auto-generated uninstall scripts before deployment.
How to check if you're exposed
Find your Fleet server version in the console or from the running binary or image tag, and compare it with 4.81.1. Then look at what has been uploaded: which software packages exist, who uploaded them and where they came from. Next, open the generated uninstall scripts for each package and read them, looking for anything beyond a normal uninstall step.
If your Fleet runs as a Go module in your own build, check the module version in go.mod.
What to do now
- Upgrade Fleet to 4.81.1 or later.
- Until then, upload only packages from sources you verify, as the advisory advises.
- Inspect and edit auto-generated uninstall scripts before deployment, also per the advisory.
- Review the list of software packages and uninstall scripts already in Fleet and remove anything you cannot trace.
- Limit who can upload software to Fleet and log those actions.
Why it matters
CWE-78 is OS command injection. Fleet reads metadata from the package file and uses it to generate scripts. The advisory says those values were not sanitized before being included, so a package with malicious values in its metadata fields could cause unintended commands when the uninstall script runs on endpoints.
The impact is large because of where the script runs. Device management tools operate with the highest privileges on every managed machine, so a flaw here has a wide reach: one crafted package, many endpoints. The trigger is an uninstall, which may happen long after the upload.
Trust in software supply chains includes the metadata inside a package, not only its code. Any pipeline that turns package fields into scripts needs to escape them the same way it would escape user input.
Quick check
What if I cannot upgrade today?
Follow the advisory: upload only packages from verified sources, and review generated uninstall scripts by hand before deploying them.
When does the command run?
The advisory says when an uninstall is triggered on a managed endpoint.
Sources
- https://github.com/fleetdm/fleet/security/advisories/GHSA-9vcr-g537-3w5v
- https://github.com/fleetdm/fleet/releases/tag/fleet-v4.81.1
Last reviewed: 19 October 2026.
