CVE-2026-101047: Fleet Information Disclosure Vulnerability

CVE-2026-101047 Overview

CVE-2026-101047 is a missing authorization vulnerability [CWE-862] in Fleet device management server versions prior to 4.87.0. The flaw affects two endpoints that serve in-house iOS application packages and manifests on the enterprise tier. These endpoints should enforce a random, time-limited URL token but fail to do so. An unauthenticated attacker with network access to the Fleet server can download in-house IPA binaries and their metadata by guessing sequential title identifiers.

Critical Impact
Unauthenticated network attackers can enumerate and download internally distributed iOS application packages, exposing bundle identifiers, versions, names, and binary contents.

Affected Products

Fleet (enterprise tier) versions prior to 4.87.0
In-house iOS application package distribution endpoints
Apple MDM InstallEnterpriseApplication workflow in Fleet

Discovery Timeline

2026-09-27 - CVE-2026-101047 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-101047

Vulnerability Analysis

Fleet distributes in-house iOS applications to managed devices through two HTTP endpoints: one serving the IPA binary and one serving the installation manifest. Apple's InstallEnterpriseApplication MDM command requires both URLs to be reachable without a Fleet web session, so session-based authentication is not an option. Fleet's design intent is to protect these endpoints with a random, time-limited URL token that functions as a capability. In versions prior to 4.87.0, the token check is missing. The endpoints respond to any request that references a valid title identifier.

The impact is bounded. The vulnerability permits read-only disclosure of in-house application artifacts and metadata including bundle identifier, version, and name. It does not permit write access or privilege escalation. The free tier is unaffected and returns fleet.ErrMissingLicense.

Root Cause

The root cause is a broken access control pattern. The endpoints rely on URL unguessability as the sole access control, but no token is validated server-side. Title identifiers are assigned sequentially, which makes enumeration trivial and defeats the intended capability-URL model.

Attack Vector

An attacker needs network reachability to the Fleet server and no credentials. The attacker iterates sequential title identifiers against the IPA and manifest endpoints. Each successful response yields the application binary and metadata used by MDM clients to install the app. Internally developed applications may contain proprietary code, embedded API keys, signing information, or business logic that aids follow-on attacks.

See the GitHub Security Advisory GHSA-q9c5-pp7m-fm2g and the VulnCheck Advisory for Fleet App for additional technical context.

Detection Methods for CVE-2026-101047

Indicators of Compromise

Unauthenticated HTTP GET requests to the in-house iOS application package and manifest endpoints originating from IP addresses outside the expected MDM device population.
Sequential or rapid enumeration of title identifiers in request URIs against the Fleet server.
Large volumes of successful 200 responses returning application/octet-stream IPA payloads or iOS manifest plists without a corresponding session cookie.

Detection Strategies

Review Fleet server access logs for requests to the enterprise in-house application endpoints that lack the expected token query parameter.
Correlate requesting source IPs with the inventory of enrolled MDM devices and flag non-device sources.
Alert on scans that walk numeric identifiers across short time windows against the same endpoint path.

Monitoring Recommendations

Forward Fleet reverse proxy and application logs to a centralized analytics pipeline for retention and correlation.
Track baseline request volumes to the IPA and manifest endpoints and alert on deviations.
Monitor outbound traffic from unexpected hosts fetching IPA binaries from Fleet.

How to Mitigate CVE-2026-101047

Immediate Actions Required

Upgrade Fleet to version 4.87.0 or later, which enforces the random, time-limited URL token on both endpoints.
Restrict network reachability to the Fleet server so only enrolled devices and management networks can reach the in-house application endpoints.
Audit server access logs for prior enumeration of title identifiers and treat exposed IPA contents as potentially disclosed.

Patch Information

The vendor fix is included in Fleet 4.87.0. Review the GitHub Security Advisory GHSA-q9c5-pp7m-fm2g for upgrade notes and verification steps.

Workarounds

Place the Fleet server behind a network boundary or VPN that limits exposure to trusted MDM device ranges until upgrading.
Rotate any secrets, API keys, or signing material embedded within in-house iOS applications that may have been exposed.
Remove non-essential in-house applications from Fleet until the upgrade is complete to reduce the disclosure surface.

bash

# Example: restrict Fleet in-house app endpoints at a reverse proxy until patched
# nginx snippet - allow only known MDM egress ranges
location ~ ^/api/.*/fleet/software/titles/[0-9]+/package {
    allow 10.20.0.0/16;    # corporate MDM egress
    allow 10.21.0.0/16;    # device WiFi range
    deny  all;
}