CVE-2026-126401
HIGH
NVD
CVSS Score
7.5
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
Fleet before 4.86.2 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory through quadratic XML canonicalization of unsigned SAML responses. Attackers can send a single crafted SAML response with deeply nested elements declaring new namespace prefixes to POST /api/v1/fleet/sso/callback, crashing the Fleet server.