Skip to main content

Fleet DM CVE-2026-103265

| EUVDEUVD-2026-90659 MEDIUM
Incorrect Authorization (CWE-863)
2026-10-01 VulnCheck GHSA-hfhg-8x2p-pvmg
Authentication Bypass Fleet Fleetdm
5.3
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
5.3 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.3 MEDIUM

Network-exploitable by an authenticated low-privileged team-scoped user (PR:L), yielding only limited cross-team read access (C:L) with no integrity or availability impact and no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Oct 01, 2026 - 11:36 vuln.today
Patch available
Oct 01, 2026 - 11:01 EUVD

DescriptionCVE.org

Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results endpoint. Team-scoped users can read MDM command results for hosts on other teams when a shared command UUID targets hosts across multiple teams, exposing host UUIDs, command payloads, and device responses.

AnalysisAI

Team-scoped users in Fleet DM before 4.89.0 can read MDM command results for hosts on other teams via the commands/results endpoint when a shared command UUID targets hosts across multiple teams, exposing host UUIDs, command payloads, and device responses. Exploitation requires an authenticated low-privileged team-scoped account on an instance with MDM features in use, and the disclosure is limited to results tied to such cross-team command UUIDs; there is no public exploit identified at time of analysis. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires an authenticated low-privileged, team-scoped Fleet account (PR:L) on a version before 4.89.0 with MDM features in use. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine but modest-severity information-disclosure flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade to Fleet 4.89.0 or later; the vendor advisory GHSA-97fg-h5wh-2399 (https://github.com/fleetdm/fleet/security/advisories/GHSA-97fg-h5wh-2399) confirms a fix in 4.89.0. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Fleet

View all
CVE-2026-23518 CRITICAL
9.8 Jan 21

Fleet device management software has a signature verification bypass that allows attackers to install malicious firmware
CVE-2020-26276 CRITICAL
9.8 Dec 17

Fleet is an open source osquery manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
CVE-2026-103264 CRITICAL
9.3 Oct 01

Unauthenticated attackers can bypass authentication in Fleet (versions before 4.87.0) by using non-secret device identif
CVE-2026-101045 HIGH
8.9 Sep 27

OS command injection in Fleet's generator for Fleet-maintained macOS app install and uninstall scripts allows crafted Ho
CVE-2026-88808 HIGH
8.8 Sep 28

Privilege escalation in SUSE Rancher Fleet (0.14.x before 0.14.11, 0.15.x before 0.15.7, and 0.16.x before 0.16.2) lets

CVE-2026-26186 HIGH
8.8 Feb 26

SQL injection in Fleet device management software before version 4.80.1 allows authenticated users to manipulate the ord
CVE-2026-23517 HIGH
8.1 Jan 21

Fleet device management software versions prior to 4.78.3 suffer from broken access control that permits any authenticat
CVE-2022-24841 HIGH
8.1 Apr 18

fleetdm/fleet is an open source device management, built on osquery. Rated high severity (CVSS 8.1), this vulnerability

CVE-2019-1020009 HIGH
7.5 Jul 29

Fleet before 2.1.2 allows exposure of SMTP credentials. Rated high severity (CVSS 7.5), this vulnerability is remotely e
CVE-2026-93538 HIGH
7.1 Sep 28

Cross-tenant authorization bypass in SUSE Rancher Fleet allows a party who can perform agent-initiated cluster registrat
CVE-2026-101047 MEDIUM
6.9 Sep 27

Unauthenticated download of in-house iOS application packages and manifests is possible against enterprise-tier Fleet de
CVE-2026-34388 MEDIUM
6.6 Mar 27

Denial-of-service vulnerability in Fleet device management software prior to version 4.81.0 allows authenticated hosts t

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2026-71362 CRITICAL POC
9.1
CVE-2026-42016 HIGH POC
8.8
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Share

CVE-2026-103265 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy