Fleet CVE-2026-24000

Fleet is an open-source device management and osquery orchestration platform written in Go. The vulnerability exists in the HTTP request handling layer where the application extracts client IP addresses from standard proxy headers without validating their authenticity or origin. The affected code relies on headers such as X-Forwarded-For, X-Real-IP, and True-Client-IP - headers commonly set by reverse proxies and load balancers to preserve the original client IP through intermediaries. However, when Fleet receives requests directly or from untrusted networks, malicious actors can inject arbitrary values into these headers, and the application will accept them as the legitimate source IP. This violates the principle of trusting only headers set by infrastructure under the application's control. The root cause is classified as CWE-290 (Authentication using Password with Weak Encryption), though more accurately this is an IP spoofing vulnerability (improper validation of IP header sources). The per-IP rate limiting mechanism likely relies on comparing request source IPs to determine throttle state, so when the IP is spoofed with each request, the attacker effectively bypasses the rate limit entirely.