Vulnerability · Published Jan 21, 2026 · Assigned by GitHub_M
CVE-2026-23518Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment
Critical 9.3
In plain English
A critical-severity security flaw in fleet from fleetdm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Fleet is open source device management software. In versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3, a vulnerability in Fleet's Windows MDM enrollment flow could allow an attacker to submit forged authentication tokens that are not properly validated. Because JWT signatures were not verified, Fleet could accept attacker-controlled identity claims, enabling enrollment of unauthorized devices under arbitrary Azure AD user identities. Versions 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 fix the issue. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/fleetdm/fleet | 4.78.3 | GHSA-63m5-974w-448v |
| Go | github.com/fleetdm/fleet | 4.77.1 | GHSA-63m5-974w-448v |
| Go | github.com/fleetdm/fleet | 4.76.2 | GHSA-63m5-974w-448v |
| Go | github.com/fleetdm/fleet | 4.75.2 | GHSA-63m5-974w-448v |
| Go | github.com/fleetdm/fleet | 4.43.5-0.20260112202845-e225ef57912c | GHSA-63m5-974w-448v |
| Go | github.com/fleetdm/fleet/v4 | 4.75.2, 4.76.2, 4.77.1, 4.78.3 | GO-2026-4335 |
Affected products (as reported)
Weakness: CWE-347 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N