Vulnerability · Published Oct 1, 2026 · Assigned by VulnCheck

CVE-2026-103264Fleet before 4.87.0 Authentication Bypass via Device Identifiers

Critical 9.1

In plain English

A critical-severity improper authentication in fleet from fleetdm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.3%top 75.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS hosts to read device data and trigger device-scoped actions including software installation and MDM migration.

Affected products (as reported)

Vendor	Product	Versions
fleetdm	fleet	0 – before 4.87.0

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

GitHub Security Advisory (GHSA-vrc8-2wcx-327f) vendor-advisory
VulnCheck Advisory: Fleet before 4.87.0 Authentication Bypass via Device Identifiers third-party-advisory