CVE-2021-21296 - Vulnerability Details - OpenCVE

Fleet is an open source osquery manager. In Fleet before version 3.7.0 a malicious actor with a valid node key can send a badly formatted request that causes the Fleet server to exit, resulting in denial of service. This is possible only while a live query is currently ongoing. We believe the impact of this vulnerability to be low given the requirement that the actor has a valid node key. There is no information disclosure, privilege escalation, or code execution. The issue is fixed in Fleet 3.7.0.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Fleetdm	Fleet

Configuration 1 [-]

cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/fleetdm/fleet/commit/f68f4238e83b45b2164e4ed05df14af0f06eaf40
https://github.com/fleetdm/fleet/security/advisories/GHSA-xwh8-9p3f-3x45
https://www.npmjs.com/package/fleetctl

History

Tue, 06 Oct 2026 14:30:00 +0000

Type	Values Removed	Values Added
CPEs	cpe:2.3:a:fleetdm:fleet::::::node.js::*	cpe:2.3:a:fleetdm:fleet::::::::

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2021-02-10T20:00:19.000Z

Updated: 2024-08-03T18:09:15.667Z

Reserved: 2020-12-22T00:00:00.000Z

Link: CVE-2021-21296

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2021-02-10T20:15:15.353

Modified: 2026-10-06T14:18:40.287

Link: CVE-2021-21296

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "fleet", "vendor": "fleetdm", "versions": [{"status": "affected", "version": "< 3.7.0"}]}], "descriptions": [{"lang": "en", "value": "Fleet is an open source osquery manager. In Fleet before version 3.7.0 a malicious actor with a valid node key can send a badly formatted request that causes the Fleet server to exit, resulting in denial of service. This is possible only while a live query is currently ongoing. We believe the impact of this vulnerability to be low given the requirement that the actor has a valid node key. There is no information disclosure, privilege escalation, or code execution. The issue is fixed in Fleet 3.7.0."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-02-10T20:00:19.000Z", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-xwh8-9p3f-3x45"}, {"tags": ["x_refsource_MISC"], "url": "https://www.npmjs.com/package/fleetctl"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/fleetdm/fleet/commit/f68f4238e83b45b2164e4ed05df14af0f06eaf40"}], "source": {"advisory": "GHSA-xwh8-9p3f-3x45", "discovery": "UNKNOWN"}, "title": "Denial-of-service in Fleet", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2021-21296", "STATE": "PUBLIC", "TITLE": "Denial-of-service in Fleet"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "fleet", "version": {"version_data": [{"version_value": "< 3.7.0"}]}}]}, "vendor_name": "fleetdm"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Fleet is an open source osquery manager. In Fleet before version 3.7.0 a malicious actor with a valid node key can send a badly formatted request that causes the Fleet server to exit, resulting in denial of service. This is possible only while a live query is currently ongoing. We believe the impact of this vulnerability to be low given the requirement that the actor has a valid node key. There is no information disclosure, privilege escalation, or code execution. The issue is fixed in Fleet 3.7.0."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-400 Uncontrolled Resource Consumption"}]}]}, "references": {"reference_data": [{"name": "https://github.com/fleetdm/fleet/security/advisories/GHSA-xwh8-9p3f-3x45", "refsource": "CONFIRM", "url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-xwh8-9p3f-3x45"}, {"name": "https://www.npmjs.com/package/fleetctl", "refsource": "MISC", "url": "https://www.npmjs.com/package/fleetctl"}, {"name": "https://github.com/fleetdm/fleet/commit/f68f4238e83b45b2164e4ed05df14af0f06eaf40", "refsource": "MISC", "url": "https://github.com/fleetdm/fleet/commit/f68f4238e83b45b2164e4ed05df14af0f06eaf40"}]}, "source": {"advisory": "GHSA-xwh8-9p3f-3x45", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T18:09:15.667Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-xwh8-9p3f-3x45"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.npmjs.com/package/fleetctl"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/fleetdm/fleet/commit/f68f4238e83b45b2164e4ed05df14af0f06eaf40"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2021-21296", "datePublished": "2021-02-10T20:00:19.000Z", "dateReserved": "2020-12-22T00:00:00.000Z", "dateUpdated": "2024-08-03T18:09:15.667Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "fleet", "vendor": "fleetdm", "versions": [{"status": "affected", "version": "< 3.7.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*", "matchCriteriaId": "DF9DDEDF-6C06-4659-B4AD-24EF544E1D7F", "versionEndExcluding": "3.7.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Fleet is an open source osquery manager. In Fleet before version 3.7.0 a malicious actor with a valid node key can send a badly formatted request that causes the Fleet server to exit, resulting in denial of service. This is possible only while a live query is currently ongoing. We believe the impact of this vulnerability to be low given the requirement that the actor has a valid node key. There is no information disclosure, privilege escalation, or code execution. The issue is fixed in Fleet 3.7.0."}, {"lang": "es", "value": "Fleet es un administrador osquery de c\u00f3digo abierto. En Fleet versiones anteriores a 3.7.0, un actor malicioso con una clave de nodo v\u00e1lida puede enviar una petici\u00f3n mal formateada que hace que el servidor Fleet salga, lo que resulta en la denegaci\u00f3n del servicio. Esto solo es posible mientras se presenta una consulta en vivo en curso. Creemos que el impacto de esta vulnerabilidad es bajo el requerimiento dado de que el actor tenga una clave de nodo v\u00e1lida. No existe una divulgaci\u00f3n de informaci\u00f3n, escalada de privilegios ni ejecuci\u00f3n de c\u00f3digo. El problema es corregido en Fleet versi\u00f3n 3.7.0"}], "id": "CVE-2021-21296", "lastModified": "2026-10-06T14:18:40.287", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 2.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-02-10T20:15:15.353", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/fleetdm/fleet/commit/f68f4238e83b45b2164e4ed05df14af0f06eaf40"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-xwh8-9p3f-3x45"}, {"source": "security-advisories@github.com", "tags": ["Product", "Third Party Advisory"], "url": "https://www.npmjs.com/package/fleetctl"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/fleetdm/fleet/commit/f68f4238e83b45b2164e4ed05df14af0f06eaf40"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-xwh8-9p3f-3x45"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product", "Third Party Advisory"], "url": "https://www.npmjs.com/package/fleetctl"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}