CVE-2026-103264

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS hosts to read device data and trigger device-scoped actions including software installation and MDM migration.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/fleetdm/fleet/security/advisories/GHSA-vrc8-2wcx-327f	Vendor Advisory
https://www.vulncheck.com/advisories/fleet-before-4.87.0-authentication-bypass-via-device-identifiers	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*

History

08 Oct 2026, 13:17

Type	Values Removed	Values Added
References	~~() https://github.com/fleetdm/fleet/security/advisories/GHSA-vrc8-2wcx-327f -~~	() https://github.com/fleetdm/fleet/security/advisories/GHSA-vrc8-2wcx-327f - Vendor Advisory
References	~~() https://www.vulncheck.com/advisories/fleet-before-4.87.0-authentication-bypass-via-device-identifiers -~~	() https://www.vulncheck.com/advisories/fleet-before-4.87.0-authentication-bypass-via-device-identifiers - Third Party Advisory
First Time		Fleetdm fleet Fleetdm
CPE		cpe:2.3:a:fleetdm:fleet::::::::

01 Oct 2026, 11:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-01 11:17

Updated : 2026-10-08 13:17

NVD link : CVE-2026-103264

Mitre link : CVE-2026-103264

CVE.ORG link : CVE-2026-103264

JSON object : View

Products Affected

fleetdm

fleet

CWE

CWE-287

Improper Authentication

{"id": "CVE-2026-103264", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-103264", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-01T13:30:37.558254Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "fleetdm", "product": "fleet", "versions": [{"status": "affected", "version": "0", "lessThan": "4.87.0", "versionType": "semver"}, {"status": "unaffected", "version": "4.87.0", "versionType": "semver"}], "packageURL": "pkg:golang/github.com/fleetdm/fleet", "defaultStatus": "unaffected"}]}], "published": "2026-10-01T11:17:21.410", "references": [{"url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-vrc8-2wcx-327f", "tags": ["Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/fleet-before-4.87.0-authentication-bypass-via-device-identifiers", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS hosts to read device data and trigger device-scoped actions including software installation and MDM migration."}], "lastModified": "2026-10-08T13:17:52.477", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EE0AEC5C-0DD8-4C44-9DC0-2B6FC0C0A083", "versionEndExcluding": "4.87.0"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}