The vulnerability is a SQL injection flaw located in Fleet's MDM bootstrap package configuration. An authenticated user with Team Admin or Global Admin privileges can submit crafted API requests that include malicious SQL statements, allowing the attacker to execute arbitrary SQL against the Fleet database. This can result in unauthorized extraction of sensitive data, modification of team configurations, and insertion of arbitrary content via the API, potentially compromising the integrity of the fleet management environment.

The affected product is Fleet, the open‑source device‑management platform from FleetDM. Versions released prior to 4.81.0 are vulnerable. The patch was applied in release 4.81.0, which removes the injection point. All installations using older versions should be considered at risk until updated.

The CVSS score of 6.3 indicates moderate severity, and no EPSS data is available. The vulnerability is not listed in the CISA KEV catalog. The attack vector requires the attacker to have authenticated access with Team Admin or Global Admin privileges, suggesting an insider or compromised account. Once authenticated, the attacker can send specially crafted API requests, exploiting the injection point in the MDM bootstrap package to execute arbitrary SQL against the database.