Nixpkgs Security Tracker

Login with GitHub

Details of issue NIXPKGS-2026-0831

NIXPKGS-2026-0831
published on 28 Mar 2026
Permalink CVE-2026-26060
updated 18 hours ago by @LeSuisse Activity log
  • Created automatic suggestion 1 day, 10 hours ago
  • @LeSuisse removed
    20 packages
    • fleetctl
    • fleeting-plugin-aws
    • azure-cli-extensions.fleet
    • python312Packages.tesla-fleet-api
    • python313Packages.tesla-fleet-api
    • python314Packages.tesla-fleet-api
    • haskellPackages.amazonka-iotfleethub
    • haskellPackages.amazonka-iotfleetwise
    • python312Packages.mypy-boto3-iotfleethub
    • python313Packages.mypy-boto3-iotfleethub
    • python314Packages.mypy-boto3-iotfleethub
    • python312Packages.mypy-boto3-iotfleetwise
    • python313Packages.mypy-boto3-iotfleetwise
    • python314Packages.mypy-boto3-iotfleetwise
    • home-assistant-component-tests.tesla_fleet
    • python312Packages.types-aiobotocore-iotfleethub
    • python313Packages.types-aiobotocore-iotfleethub
    • python312Packages.types-aiobotocore-iotfleetwise
    • python313Packages.types-aiobotocore-iotfleetwise
    • tests.home-assistant-component-tests.tesla_fleet
    18 hours ago
  • @LeSuisse accepted 18 hours ago
  • @LeSuisse published on GitHub 18 hours ago
Fleet: Password reset tokens remain valid after password change for 24 hours

Fleet is open source device management software. Prior to 4.81.0, a vulnerability in Fleet’s password management logic could allow previously issued password reset tokens to remain valid after a user changes their password. As a result, a stale password reset token could be reused to reset the account password even after a defensive password change. Version 4.81.0 patches the issue.

References

Affected products

fleet
  • ==< 4.81.0

Matching in nixpkgs

Ignored packages (20)

Package maintainers

Advisory: https://github.com/fleetdm/fleet/security/advisories/GHSA-3458-r943-hmx4