From 30f1719aca102d94bfd746f045cc05f842ee782d Mon Sep 17 00:00:00 2001
From: Lucas Manuel Rodriguez <lucas@fleetdm.com>
Date: Wed, 8 Apr 2026 17:46:41 -0300
Subject: [PATCH] Ignore CVEs on fleetdm/fleetctl (#43240)

Fixes:
https://github.com/fleetdm/fleet/actions/runs/24121419823/job/70444895796

Run: https://github.com/fleetdm/fleet/actions/runs/24142910735
---
 security/status.md                            | 24 +++++++++++++++++
 security/vex/fleetctl/CVE-2026-0968.vex.json  | 26 +++++++++++++++++++
 security/vex/fleetctl/CVE-2026-34873.vex.json | 26 +++++++++++++++++++
 security/vex/fleetctl/CVE-2026-34875.vex.json | 26 +++++++++++++++++++
 4 files changed, 102 insertions(+)
 create mode 100644 security/vex/fleetctl/CVE-2026-0968.vex.json
 create mode 100644 security/vex/fleetctl/CVE-2026-34873.vex.json
 create mode 100644 security/vex/fleetctl/CVE-2026-34875.vex.json

diff --git a/security/status.md b/security/status.md
index 85f7ec914d..c1104b0164 100644
--- a/security/status.md
+++ b/security/status.md
@@ -172,6 +172,22 @@ Following is the vulnerability report of Fleet and its dependencies.
 - **Justification:** `vulnerable_code_not_in_execute_path`
 - **Timestamp:** 2026-03-23 16:44:57
 
+### [CVE-2026-34875](https://nvd.nist.gov/vuln/detail/CVE-2026-34875)
+- **Author:** @lucasmrod
+- **Status:** `not_affected`
+- **Status notes:** fleetdm/fleetctl does not use Mbed TLS. The libmbedcrypto16 package is an unused transitive dependency in the container image.
+- **Products:**: `fleetctl`,`pkg:deb/debian/libmbedcrypto16`
+- **Justification:** `vulnerable_code_not_in_execute_path`
+- **Timestamp:** 2026-04-08 12:06:49
+
+### [CVE-2026-34873](https://nvd.nist.gov/vuln/detail/CVE-2026-34873)
+- **Author:** @lucasmrod
+- **Status:** `not_affected`
+- **Status notes:** fleetdm/fleetctl does not use Mbed TLS. The libmbedcrypto16 package is an unused transitive dependency in the container image.
+- **Products:**: `fleetctl`,`pkg:deb/debian/libmbedcrypto16`
+- **Justification:** `vulnerable_code_not_in_execute_path`
+- **Timestamp:** 2026-04-08 12:06:46
+
 ### [CVE-2026-33487](https://nvd.nist.gov/vuln/detail/CVE-2026-33487)
 - **Author:** @lucasmrod
 - **Status:** `not_affected`
@@ -228,6 +244,14 @@ Following is the vulnerability report of Fleet and its dependencies.
 - **Justification:** `component_not_present`
 - **Timestamp:** 2026-01-30 09:25:41
 
+### [CVE-2026-0968](https://nvd.nist.gov/vuln/detail/CVE-2026-0968)
+- **Author:** @lucasmrod
+- **Status:** `not_affected`
+- **Status notes:** fleetdm/fleetctl does not use libssh. The libssh-4 package is an unused transitive dependency in the container image.
+- **Products:**: `fleetctl`,`pkg:deb/debian/libssh-4`
+- **Justification:** `vulnerable_code_not_in_execute_path`
+- **Timestamp:** 2026-04-08 12:06:51
+
 ### [CVE-2025-69419](https://nvd.nist.gov/vuln/detail/CVE-2025-69419)
 - **Author:** @lucasmrod
 - **Status:** `not_affected`
diff --git a/security/vex/fleetctl/CVE-2026-0968.vex.json b/security/vex/fleetctl/CVE-2026-0968.vex.json
new file mode 100644
index 0000000000..7938cc0009
--- /dev/null
+++ b/security/vex/fleetctl/CVE-2026-0968.vex.json
@@ -0,0 +1,26 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@id": "https://openvex.dev/docs/public/vex-37b25bd9a968efce3f08b579d76ffa37ca3f758126188084423cb67b4b9fd478",
+  "author": "@lucasmrod",
+  "timestamp": "2026-04-08T12:06:51.309277-03:00",
+  "version": 1,
+  "statements": [
+    {
+      "vulnerability": {
+        "name": "CVE-2026-0968"
+      },
+      "timestamp": "2026-04-08T12:06:51.309277-03:00",
+      "products": [
+        {
+          "@id": "fleetctl"
+        },
+        {
+          "@id": "pkg:deb/debian/libssh-4"
+        }
+      ],
+      "status": "not_affected",
+      "status_notes": "fleetdm/fleetctl does not use libssh. The libssh-4 package is an unused transitive dependency in the container image.",
+      "justification": "vulnerable_code_not_in_execute_path"
+    }
+  ]
+}
diff --git a/security/vex/fleetctl/CVE-2026-34873.vex.json b/security/vex/fleetctl/CVE-2026-34873.vex.json
new file mode 100644
index 0000000000..e43f06b47c
--- /dev/null
+++ b/security/vex/fleetctl/CVE-2026-34873.vex.json
@@ -0,0 +1,26 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@id": "https://openvex.dev/docs/public/vex-756a0db110c65dbac8702e2ac4659c66ac357d6a8b5a31664ba1cc57bafa51dd",
+  "author": "@lucasmrod",
+  "timestamp": "2026-04-08T12:06:46.615805-03:00",
+  "version": 1,
+  "statements": [
+    {
+      "vulnerability": {
+        "name": "CVE-2026-34873"
+      },
+      "timestamp": "2026-04-08T12:06:46.615805-03:00",
+      "products": [
+        {
+          "@id": "fleetctl"
+        },
+        {
+          "@id": "pkg:deb/debian/libmbedcrypto16"
+        }
+      ],
+      "status": "not_affected",
+      "status_notes": "fleetdm/fleetctl does not use Mbed TLS. The libmbedcrypto16 package is an unused transitive dependency in the container image.",
+      "justification": "vulnerable_code_not_in_execute_path"
+    }
+  ]
+}
diff --git a/security/vex/fleetctl/CVE-2026-34875.vex.json b/security/vex/fleetctl/CVE-2026-34875.vex.json
new file mode 100644
index 0000000000..8f48a473ae
--- /dev/null
+++ b/security/vex/fleetctl/CVE-2026-34875.vex.json
@@ -0,0 +1,26 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@id": "https://openvex.dev/docs/public/vex-859603b049c3e908489f4cc4318759aa6ad0371dea550ba59daf9cf5a40827ed",
+  "author": "@lucasmrod",
+  "timestamp": "2026-04-08T12:06:49.058533-03:00",
+  "version": 1,
+  "statements": [
+    {
+      "vulnerability": {
+        "name": "CVE-2026-34875"
+      },
+      "timestamp": "2026-04-08T12:06:49.058534-03:00",
+      "products": [
+        {
+          "@id": "fleetctl"
+        },
+        {
+          "@id": "pkg:deb/debian/libmbedcrypto16"
+        }
+      ],
+      "status": "not_affected",
+      "status_notes": "fleetdm/fleetctl does not use Mbed TLS. The libmbedcrypto16 package is an unused transitive dependency in the container image.",
+      "justification": "vulnerable_code_not_in_execute_path"
+    }
+  ]
+}