Fixes:
https://github.com/fleetdm/fleet/actions/runs/28775213423/job/85317520154.
New run: https://github.com/fleetdm/fleet/actions/runs/28779783653.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Added vulnerability status information for a known issue affecting
`fleetctl`, clarifying that it is not impacted by the reported problem.
* Included a note explaining why the affected code path is not reached
in typical use.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Failures:
- WiX: https://github.com/fleetdm/fleet/actions/runs/28500663153
- fleetctl: https://github.com/fleetdm/fleet/actions/runs/28501229768
New runs:
- WiX: https://github.com/fleetdm/fleet/actions/runs/28521840457
- fleetctl: https://github.com/fleetdm/fleet/actions/runs/28521833124
Adds VEX exclusions for false-positive vulnerabilities flagged by the
scheduled Trivy scans of the `fleetdm/wix` and `fleetdm/fleetctl`
images.
**wix**
([run](https://github.com/fleetdm/fleet/actions/runs/28500663153)):
- `CVE-2026-8461` — ffmpeg libs (libavcodec61, libavformat61,
libavutil59, libswresample5); fleetctl does not process media files when
using fleetdm/wix.
- `CVE-2026-55199`, `CVE-2026-55200`, `CVE-2026-7598` — libssh2-1t64;
fleetctl does not establish SSH connections when generating MSI
packages.
**fleetctl**
([run](https://github.com/fleetdm/fleet/actions/runs/28501229768)):
- `CVE-2026-54512`, `CVE-2026-54513` —
com.fasterxml.jackson.core:jackson-databind; fleetctl does not use Java.
All statements are `not_affected` /
`vulnerable_code_not_in_execute_path`, consistent with existing VEX
entries in these directories. The scan workflows auto-glob the VEX
directories, so no workflow changes are needed.
# Checklist for submitter
- [x] QA'd all new/changed functionality manually (validated JSON;
mirrors existing VEX statements picked up by the scan workflow)
There was a change and now https://github.com/fleetdm/fleet/issues/44374
is to be released in 4.84.2
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated recommended patch versions for addressing critical security
vulnerabilities to ensure enhanced protection.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Updating CVE notes with new information for:
- CVE-2026-39883 (only affects BSD and Solaris).
- CVE-2026-32281, CVE-2026-32283: To be fixed in
[v4.84.1](https://github.com/fleetdm/fleet/milestone/246).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Security Updates**
* Updated Fleet vulnerability advisories and remediation guidance with
corrected upgrade recommendations to ensure users receive accurate
information for addressing security issues
* Enhanced vulnerability assessments with additional platform
compatibility information to help users better evaluate applicable risks
to their environments
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes: https://github.com/fleetdm/fleet/actions/runs/24981188476.
Run: https://github.com/fleetdm/fleet/actions/runs/25009852107.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Chores**
* Added vulnerability impact assessments for four CVEs (CVE-2026-28387,
CVE-2026-28388, CVE-2026-28389, CVE-2026-31789). Documentation confirms
these vulnerabilities do not affect the product.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes:
https://github.com/fleetdm/fleet/actions/runs/24980770051/job/73142219314.
Run: https://github.com/fleetdm/fleet/actions/runs/25018399091.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added OpenVEX vulnerability declarations for multiple CVEs, marking
them as not affected for Fleet and fleetctl. Each entry includes
metadata, human-readable status notes, and justifications addressing
exploitability relative to Go runtime, Alpine/musl packages, crypto/SSL
libraries, OpenTelemetry, xmldsig, and media libraries.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Extra colon in the "Products:" section auto-generated file:
<img width="228" height="59" alt="Screenshot 2026-04-20 at 3 07 26 PM"
src="https://github.com/user-attachments/assets/687be6ea-71ae-45c7-a1e9-641994ee86ba"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Corrected formatting in product list display by removing redundant
punctuation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Run: https://github.com/fleetdm/fleet/actions/runs/24681592163.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added vulnerability disclosures for three CVEs.
* CVE-2026-27806: marked as not affecting fleetctl.
* CVE-2026-32280: denial-of-service affecting many fleetctl versions;
recommend upgrading to a fleetctl build using Go ≥1.26.2 when available.
* CVE-2026-33810: affects fleetctl v4.84.0; recommend upgrading to a
fleetctl build using Go ≥1.26.2 when available.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Run: https://github.com/fleetdm/fleet/actions/runs/24676558778.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added security vulnerability assessments for CVE-2026-28390,
CVE-2026-4775, and CVE-2026-5201, confirming these issues do not affect
the product. Statements note that vulnerable code is not in the
product’s execution path and relevant processing (TLS/TIFF/graphics) is
not performed by the shipped components. Includes timestamps and
metadata for traceability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Run: https://github.com/fleetdm/fleet/actions/runs/24673271270
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Security**
* Added vulnerability assessment documentation for CVE-2026-28390,
confirming that bomutils is not affected by this vulnerability.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixing https://github.com/fleetdm/fleet/actions/runs/18150944735.
- It seems that when not using the RC versions it cannot determine the
version of the github.com/fleetdm/fleet/v4 package , so it assumes it's
using `v4.0.0` thus causing alerts around our recent SAML vulnerability
(already fixed). So I'm changing it to only run on RC cuts, not every
day.
- Also adding a skip rule for a new CVE that we are not affected by.
#29482
[Migrate to the AWS SDK for Go
v2](https://docs.aws.amazon.com/sdk-for-go/v2/developer-guide/migrate-gosdk.html)
documents how to migrate codebases.
QA on features that use AWS SDK Go:
- Bootstrap package:
- upload: ✅
- download: ✅
- cleanup: ✅
- Software (upload, download, installation, etc.) ✅
- Cloudfront: Luckly, this feature was already using aws-sdk-go-v2.
- Carves ✅
- Logging:
- Firehose ✅
- Kinesis ✅
- Lambda ✅ (tested result logs to a lambda function on our AWS Dogfood
account)
- Email:
- Amazon SES TODO ⚠️ (this is what Dogfood uses and a few customers)
- We cannot easily test locally, we can use dogfood or load testing
(AWS) environments.
---
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Manual QA for all new/changed functionality
We missed to add this when we upgraded Go to 1.24.4.
Report
https://github.com/fleetdm/fleet/actions/runs/15626203997/job/44020838145
How to test (with and without the new VEX file):
```
docker scout cves --only-fixed --vex-location=./security/vex/fleet --only-vex-affected --only-severity high,critical fleetdm/fleet:v4.69.0
```
This PR adds VEX statement files for three vulverabilities:
```
┌─────────┬────────────────┬──────────┬──────────┬─────────────────────────┬───────────────┬──────────────────────────────────────────────────────────────┐
│ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │
├─────────┼────────────────┼──────────┼──────────┼─────────────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
│ libxml2 │ CVE-2025-49794 │ CRITICAL │ affected │ 2.9.14+dfsg-1.3~deb12u1 │ │ libxml: Heap use after free (UAF) leads to Denial of service │
│ │ │ │ │ │ │ (DoS)... │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-49794 │
│ ├────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2025-49795 │ │ │ │ │ libxml: Null pointer dereference leads to Denial of service │
│ │ │ │ │ │ │ (DoS) │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-49795 │
│ ├────────────────┤ │ │ ├───────────────┼──────────────────────────────────────────────────────────────┤
│ │ CVE-2025-49796 │ │ │ │ │ libxml: Type confusion leads to Denial of service (DoS) │
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2025-49796 │
└─────────┴────────────────┴──────────┴──────────┴─────────────────────────┴───────────────┴──────────────────────────────────────────────────────────────┘
```
the vulnerabilities in libxml2 do not affect fleetctl, since the attack
vector is DoS and fleetctl is not a server tool. Additionally the
libxml2 package isn't used by fleetctl directly, but by the tools it
uses for code signing, which don't parse untrusted XML.
For #27042.
Ready for review, just missing integration tests that I will be writing
today.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [X] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.
- [X] If database migrations are included, checked table schema to
confirm autoupdate
- For new Fleet configuration settings
- [X] Verified that the setting can be managed via GitOps, or confirmed
that the setting is explicitly being excluded from GitOps. If managing
via Gitops:
- [X] Verified that the setting is exported via `fleetctl
generate-gitops`
- [X] Added the setting to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [X] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [x] Verified that any relevant UI is disabled when GitOps mode is
enabled
- For database migrations:
- [X] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [X] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [X] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
- [x] Added/updated automated tests
- [X] Manual QA for all new/changed functionality
---------
Co-authored-by: jacobshandling <61553566+jacobshandling@users.noreply.github.com>
Co-authored-by: Jacob Shandling <jacob@fleetdm.com>
I fixed [this](https://github.com/fleetdm/fleet/pull/29692) incorrectly
the first time (my trivy setup is broken on my workstation and I missed
the CI check failure on the original PR).
