GHSA-4r5r-ccr6-q6f6 Fleet has an Access Control vulnerability in debug/pprof endpoints

• Go github.com/fleetdm/fleet: >= 4.78.0, < 4.78.3 → fixed in 4.78.3 • Go github.com/fleetdm/fleet: >= 4.77.0, < 4.77.1 → fixed in 4.77.1 • Go github.com/fleetdm/fleet: >= 4.76.0, < 4.76.2 → fixed in 4.76.2 • Go github.com/fleetdm/fleet: >= 4.75.0, < 4.75.2 → fixed in 4.75.2 • Go github.com/fleetdm/fleet/v4: < 4.78.3-0.20260112221730-5c030e32a3a9 → fixed in 4.78.3-0.20260112221730-5c030e32a3a9

Summary A broken access control issue in Fleet allowed authenticated users to access debug and profiling endpoints regardless of role. As a result, low-privilege users could view internal server diagnostics and trigger resource-intensive profiling operations. Impact Fleet’s debug/pprof endpoints are accessible to any authenticated user regardless of role, including the lowest-privilege “Observer” role. This allows low-privilege users to access sensitive server internals, including runtime profiling data and in-memory application state, and to trigger CPU-intensive profiling operations that could lead to denial of service. Patches • 4.78.3 • 4.77.1 • 4.76.2 • 4.75.2 • 4.53.3 Workarounds If an immediate upgrade is not possible, users should put the debug/pprof endpoints behind an IP allowlist. For more information If you have any questions or comments about this advisory: Email us at [email protected] Join #fleet in osquery Slack Credits We thank @secfox-ai for responsibly reporting this issue.