{"id":"CVE-2020-26276","details":"Fleet is an open source osquery manager. In Fleet before version 3.5.1, due to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from a SAML IdP. Users that configure Fleet with SSO login may be vulnerable to this issue. This issue is patched in 3.5.1. The fix was made using https://github.com/mattermost/xml-roundtrip-validator If upgrade to 3.5.1 is not possible, users should disable SSO authentication in Fleet.","aliases":["GHSA-w3wf-cfx3-6gcx"],"modified":"2026-05-30T16:34:33.300716Z","published":"2020-12-17T20:15:13.760Z","references":[{"type":"ADVISORY","url":"https://github.com/fleetdm/fleet/blob/master/CHANGELOG.md#fleet-351-dec-14-2020"},{"type":"ADVISORY","url":"https://github.com/fleetdm/fleet/security/advisories/GHSA-w3wf-cfx3-6gcx"},{"type":"ADVISORY","url":"https://github.com/mattermost/xml-roundtrip-validator"},{"type":"ADVISORY","url":"https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities"},{"type":"FIX","url":"https://github.com/fleetdm/fleet/commit/57812a532e5f749c8e18c6f6a652eca65c083607"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/fleetdm/fleet","events":[{"introduced":"0"},{"fixed":"55a2aa2c955a99483b730e60207e4afada7bda8a"},{"fixed":"57812a532e5f749c8e18c6f6a652eca65c083607"}],"database_specific":{"source":["CPE_RANGE","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"3.5.1"}],"cpe":"cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*"}}],"versions":["3.5.0","3.4.0","3.3.0","3.2.0","3.1.0","3.0.0","2.6.0","2.5.0","2.4.0","2.3.0","2.2.0","2.1.2","2.1.1","2.1.0","2.0.2","2.0.1","2.0.0","2.0.0-rc5","2.0.0-rc4","2.0.0-rc3","2.0.0-rc2","2.0.0-rc1","1.0.7","1.0.6","1.0.5","1.0.4","1.0.3","1.0.2","1.0.1","1.0.0","1.0.0-rc2","1.0.0-rc1"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-26276.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}