CVE-2026-34385: 
NixOS vulnerability analysis and mitigation

CVE-2026-34385 is a second-order SQL injection vulnerability in Fleet's Apple MDM profile delivery pipeline that allows an attacker with a valid MDM enrollment certificate to exfiltrate or modify the Fleet database, including user credentials, API tokens, and device enrollment secrets. It affects all versions of FleetDM Fleet prior to 4.81.0 (Go package github.com/fleetdm/fleet/v4). The vulnerability was published on March 27, 2026, with a patch released in version 4.81.0. It carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 6.2 (Medium) (GitHub Advisory, Github Advisory).

The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). During the Apple MDM Authenticate check-in, a device-supplied UDID is initially stored safely using parameterized queries; however, when an async worker later processes the queued job, the UDID is interpolated directly into SQL statements without sanitization — a classic second-order (stored) SQL injection pattern. This enables blind, boolean-based, and UNION-based SQL injection across four simultaneous subqueries. Because Fleet's database driver is configured with multiStatements=true, stacked queries are also possible, allowing arbitrary writes. Exploitation requires a valid SCEP-issued enrollment certificate (mTLS), meaning any enrolled device — including attacker-controlled ones — can trigger the vulnerability; instances with Apple MDM disabled are not affected (GitHub Advisory, Github Advisory).

Successful exploitation allows an authenticated attacker to exfiltrate the entire Fleet database, exposing user credentials, API tokens, and device enrollment secrets. Beyond data theft, the multiStatements=true driver configuration enables arbitrary database writes, including inserting rogue admin accounts, altering Fleet configuration, deploying malicious MDM profiles or scripts to all managed devices, and deleting data. This effectively grants full control over the Fleet device management platform and all enrolled endpoints, with significant potential for lateral movement across the managed device fleet (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.009% (1st percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation does require a valid SCEP-issued MDM enrollment certificate, which limits the attacker pool to those who can enroll a device — a relatively low bar for a motivated attacker with access to the MDM environment. The vulnerability was responsibly disclosed by researcher @secfox-ai (prateek-0490) (GitHub Advisory).

1. Obtain MDM Enrollment Certificate: Enroll an attacker-controlled Apple device (or simulate one) into the target Fleet instance to obtain a valid SCEP-issued enrollment certificate, which is required for mTLS authentication during MDM check-in.
2. Craft Malicious UDID: Prepare a malicious UDID string containing SQL injection payloads (e.g., UNION-based, boolean-based blind, or stacked query payloads) designed to execute when interpolated into SQL by the async worker.
3. Send Malicious MDM Authenticate Check-in: Submit an MDM Authenticate check-in request to the Fleet MDM endpoint using the enrollment certificate for mTLS, supplying the crafted malicious UDID. The UDID is stored in the database via parameterized queries at this stage, so no immediate error occurs.
4. Trigger Async Worker Processing: Wait for or trigger Fleet's async worker to process the queued MDM job. The worker interpolates the stored UDID directly into SQL, executing the injected payload.
5. Exfiltrate or Modify Data: Use blind/boolean-based techniques to extract database contents (user credentials, API tokens, enrollment secrets), or leverage stacked queries (enabled by multiStatements=true) to insert admin accounts, modify configuration, or deploy malicious profiles to managed devices (GitHub Advisory).

• Network: Unusual or repeated MDM Authenticate check-in requests from unknown or unexpected device UDIDs; mTLS connections from devices not recognized in the device inventory.
• Database/Logs: SQL query logs showing anomalous UNION, OR, AND boolean expressions, or stacked semicolon-delimited statements originating from MDM job processing; unexpected new admin accounts or configuration changes in the Fleet database.
• Application Logs: Fleet async worker logs showing errors or unexpected behavior when processing MDM Authenticate jobs; log entries referencing UDIDs containing SQL metacharacters (e.g., ', --, ;, UNION, SELECT).
• File System / Configuration: Unexpected MDM profiles or scripts deployed to managed devices; new or modified Fleet admin accounts not created through normal provisioning workflows; altered Fleet configuration entries in the database.

The primary remediation is to upgrade Fleet to version 4.81.0 or later, which patches the second-order SQL injection by eliminating direct UDID interpolation into SQL in the async worker (GitHub Advisory). If an immediate upgrade is not possible, the recommended workaround is to temporarily disable Apple MDM in Fleet, as the vulnerability only affects instances with Apple MDM enabled. Additionally, administrators should audit MDM enrollment certificates for unauthorized enrollments, review database access logs for suspicious query patterns, and rotate user credentials, API tokens, and device enrollment secrets as a precautionary measure.

The vulnerability was responsibly disclosed by researcher @secfox-ai (GitHub: prateek-0490) and published by Fleet maintainer lukeheath on March 27, 2026 (GitHub Advisory). The advisory was picked up by standard vulnerability tracking feeds including NVD, Red Hat CVE database, ENISA EUVD, and GitLab Advisories shortly after disclosure. No significant broader media coverage or notable public researcher commentary beyond the official advisory has been identified.