EUVD-2026-90658
GHSA-rmfg-c7hm-wv58
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated API call with non-secret identifier (AV:N/AC:L/PR:N/UI:N); high confidentiality (device data) and integrity (software install/MDM migration), no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS hosts to read device data and trigger device-scoped actions including software installation and MDM migration.
AnalysisAI
Unauthenticated attackers can bypass authentication in Fleet (versions before 4.87.0) by using non-secret device identifiers like hostnames or hardware serials as tokens, allowing them to impersonate iOS/iPadOS hosts, read device data, and trigger device-scoped actions such as software installation and MDM migration. Exploitation requires knowledge of a valid identifier but no privileges or user interaction; no public exploit code has been identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation targets Fleet device management deployments (versions before 4.87.0) that have iOS/iPadOS hosts enrolled and expose the device API, which by default accepts hostnames and hardware serials as authentication tokens alongside the intended secret device UUID. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue, not a CVSS-inflated one. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Fleet 4.87.0 or later to fix this vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Fleet deployments and confirm which instances are running versions earlier than 4.87.0; reduce exposure by placing the Fleet server behind restricted network access and limiting management API reachability to trusted networks and administrative hosts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Fleet device management software has a signature verification bypass that allows attackers to install malicious firmware
Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
OS command injection in Fleet's generator for Fleet-maintained macOS app install and uninstall scripts allows crafted Ho
Privilege escalation in SUSE Rancher Fleet (0.14.x before 0.14.11, 0.15.x before 0.15.7, and 0.16.x before 0.16.2) lets
SQL injection in Fleet device management software before version 4.80.1 allows authenticated users to manipulate the ord
Fleet device management software versions prior to 4.78.3 suffer from broken access control that permits any authenticat
fleetdm/fleet is an open source device management, built on osquery. Rated high severity (CVSS 8.1), this vulnerability
Fleet before 2.1.2 allows exposure of SMTP credentials. Rated high severity (CVSS 7.5), this vulnerability is remotely e
Cross-tenant authorization bypass in SUSE Rancher Fleet allows a party who can perform agent-initiated cluster registrat
Unauthenticated download of in-house iOS application packages and manifests is possible against enterprise-tier Fleet de
Denial-of-service vulnerability in Fleet device management software prior to version 4.81.0 allows authenticated hosts t
Fleet device management software versions prior to 4.81.1 allow malicious enrolled Windows devices to access Mobile Devi
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today