CVE-2026-103264

9.1 Critique

Publiée le 01/10/2026 à 13:17 · Modifiée le 08/10/2026 à 15:17 · Analysée par le NVD · Source : disclosure@vulncheck.com

Description

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS hosts to read device data and trigger device-scoped actions including software installation and MDM migration.

Traduire en français

Produits concernés

fleetdm fleet

Scores CVSS

Version	Score	Source	Vecteur
4.0	9.3 Critique	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	9.1 Critique	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`

Faiblesses (CWE)

CWE-287

Références

https://github.com/fleetdm/fleet/security/advisories/GHSA-vrc8-2wcx-327f Vendor Advisory
https://www.vulncheck.com/advisories/fleet-before-4.87.0-authentication-bypass-via-device-identifiers Third Party Advisory

CVE-2026-103264

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs