Fleet, an open source device‑management platform, contains a denial‑of‑service vulnerability in its gRPC Launcher endpoint. An attacker who can authenticate as a host can send a log message with an unexpected log type, causing the server to crash instantly. The crash destroys all active connections, halting host communication, MDM enrolments, and API availability, which can disrupt large fleets and render management interfaces unusable.

The vulnerability affects the Fleet application from the fleetdm vendor. Versions prior to 4.81.0 are impacted. Users running any 4.x build before the 4.81.0 release are exposed; this includes the open source community edition and any supported distributions that have not yet been updated.

The reported CVSS score of 6.6 indicates moderate severity, and the very low EPSS score (<1%) suggests the likelihood of exploitation is currently small. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Exploitation requires an authenticated host, so an attacker who compromises a fleet host or elevates privileges could trigger the crash. Because the crash terminates the Fleet server process outright, the impact is immediate and wide‑spread denial of service for all connected clients until the process is restarted.