Skip to main content

Fleet CVE-2026-101047

| EUVDEUVD-2026-87978 MEDIUM
Missing Authorization (CWE-862)
2026-09-27 VulnCheck GHSA-jqp5-cmc9-xwxg
Authentication Bypass Apple Fleet Go Fleetdm
6.9
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

Unauthenticated network access with low complexity (PR:N/AC:L/AV:N), but impact is limited to read-only disclosure of app binaries/metadata, so C:L and I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

5
Metadata Corrected
Sep 27, 2026 - 18:40 vuln.today
tag: Go added
Metadata Corrected
Sep 27, 2026 - 18:40 vuln.today
tag: Privilege Escalation removed
Analysis Generated
Sep 27, 2026 - 18:04 vuln.today
Patch available
Sep 27, 2026 - 18:01 EUVD
CVE Published
Sep 27, 2026 - 17:02 cve.org
MEDIUM 6.9

DescriptionCVE.org

Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enterprise tier only) with the intended random, time-limited URL token. Because Apple's InstallEnterpriseApplication MDM command requires these URLs to be reachable without a Fleet session, they cannot rely on session-based authentication, and the missing token allows an unauthenticated attacker with network access to the Fleet server to download in-house IPA binaries and their metadata (bundle identifier, version, and name) by guessing sequential title identifiers. The impact is limited to read-only disclosure; there is no privilege escalation or write access, and the free tier is unaffected (it returns fleet.ErrMissingLicense).

AnalysisAI

Unauthenticated download of in-house iOS application packages and manifests is possible against enterprise-tier Fleet deployments running versions before 4.87.0, because two sessionless MDM endpoints were shipped without the intended random, time-limited URL token, letting anyone with network reach to the Fleet server fetch IPA binaries and their metadata (bundle identifier, version, name) by guessing sequential title identifiers. Impact is confined to read-only information disclosure - there is no privilege escalation or write access, the free tier is unaffected (it returns fleet.ErrMissingLicense), and hosts not managed by Fleet are untouched. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires an enterprise-tier Fleet deployment (free tier returns fleet.ErrMissingLicense and is not vulnerable) running a version before 4.87.0, with in-house iOS applications distributed through Fleet's MDM. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor CVSS 4.0 score of 6.9 (MEDIUM) overstates the practical urgency for most defenders. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Vendor-released patch: 4.87.0 - upgrade Fleet to 4.87.0 or later, which restores the intended random, time-limited URL token on the in-house iOS app package and manifest endpoints (see the GHSA advisory at https://github.com/fleetdm/fleet/security/advisories/GHSA-q9c5-pp7m-fm2g). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Fleet

View all
CVE-2026-23518 CRITICAL
9.8 Jan 21

Fleet device management software has a signature verification bypass that allows attackers to install malicious firmware
CVE-2020-26276 CRITICAL
9.8 Dec 17

Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
CVE-2026-103264 CRITICAL
9.3 Oct 01

Unauthenticated attackers can bypass authentication in Fleet (versions before 4.87.0) by using non-secret device identif
CVE-2026-101045 HIGH
8.9 Sep 27

OS command injection in Fleet's generator for Fleet-maintained macOS app install and uninstall scripts allows crafted Ho
CVE-2026-88808 HIGH
8.8 Sep 28

Privilege escalation in SUSE Rancher Fleet (0.14.x before 0.14.11, 0.15.x before 0.15.7, and 0.16.x before 0.16.2) lets

CVE-2026-26186 HIGH
8.8 Feb 26

SQL injection in Fleet device management software before version 4.80.1 allows authenticated users to manipulate the ord
CVE-2026-23517 HIGH
8.1 Jan 21

Fleet device management software versions prior to 4.78.3 suffer from broken access control that permits any authenticat
CVE-2022-24841 HIGH
8.1 Apr 18

fleetdm/fleet is an open source device management, built on osquery. Rated high severity (CVSS 8.1), this vulnerability

CVE-2019-1020009 HIGH
7.5 Jul 29

Fleet before 2.1.2 allows exposure of SMTP credentials. Rated high severity (CVSS 7.5), this vulnerability is remotely e
CVE-2026-93538 HIGH
7.1 Sep 28

Cross-tenant authorization bypass in SUSE Rancher Fleet allows a party who can perform agent-initiated cluster registrat
CVE-2026-34388 MEDIUM
6.6 Mar 27

Denial-of-service vulnerability in Fleet device management software prior to version 4.81.0 allows authenticated hosts t
CVE-2026-34391 MEDIUM
6.6 Mar 27

Fleet device management software versions prior to 4.81.1 allow malicious enrolled Windows devices to access Mobile Devi

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Share

CVE-2026-101047 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy