CVE-2026-103264: Fleetdm Fleet Auth Bypass Vulnerability

CVE-2026-103264 Overview

CVE-2026-103264 is an authentication bypass vulnerability in Fleet, the open-source device management platform from fleetdm. Versions before 4.87.0 accept hostnames and hardware serial numbers as valid authentication tokens on the device API, in addition to the intended device UUIDs. Because hostnames and hardware serials are not secret values, unauthenticated attackers who know or guess these identifiers can impersonate enrolled iOS and iPadOS hosts. Successful impersonation lets attackers read device data and trigger device-scoped actions, including software installation and Mobile Device Management (MDM) migration. The flaw is classified under [CWE-287: Improper Authentication].

Critical Impact
Unauthenticated network attackers can impersonate managed Apple devices to exfiltrate inventory data, push software, or migrate devices to attacker-controlled MDM infrastructure.

Affected Products

Fleetdm Fleet versions prior to 4.87.0
iOS and iPadOS hosts enrolled in affected Fleet instances
Deployments exposing the Fleet device API to untrusted networks

Discovery Timeline

2026-10-01 - CVE-2026-103264 published to the National Vulnerability Database
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2026-103264

Vulnerability Analysis

Fleet exposes a device API that enrolled hosts use to report state and receive management actions. The API is designed to authenticate requests using the per-device UUID, a value that functions as a bearer token. In versions prior to 4.87.0, the authentication routine also accepts hostnames and hardware serial numbers as valid credentials. These values are inventory identifiers, not secrets, and are commonly recorded in asset management systems, support tickets, procurement records, and user documentation.

An attacker who learns or guesses a serial number or hostname can present it to the device API and receive the same authorization context as the legitimate host. The scope of allowed actions includes reading device metadata and triggering device-scoped operations such as software installation and MDM migration. MDM migration is particularly consequential because it can transfer management authority of an Apple device to an attacker-controlled server.

Root Cause

The root cause is a credential validation routine that treats non-secret identifiers as equivalent to the UUID bearer token. Rather than requiring a cryptographically unpredictable value, the authentication path falls back to lookups by hostname and hardware serial. This violates the principle that authentication tokens must be unguessable and confidential.

Attack Vector

The attack vector is network-based, requires no privileges, and requires no user interaction. An attacker sends crafted requests to the Fleet device API endpoints, substituting a known or enumerated hostname or Apple hardware serial in place of a UUID. Apple hardware serials follow a known format and partial-structure guessing is feasible for targeted organizations. Once accepted, the attacker can issue read requests to harvest device inventory or invoke device-scoped actions, including initiating MDM migration to redirect the device to a rogue management server.

No public proof-of-concept exploit code has been published. Technical details are available in the GitHub Security Advisory GHSA-vrc8-2wcx-327f and the VulnCheck Advisory: Fleet Authentication Bypass.

Detection Methods for CVE-2026-103264

Indicators of Compromise

Device API requests presenting hostnames or hardware serial numbers in fields that should contain a UUID.
Unexpected MDM migration events or changes in the enrolled MDM server for iOS and iPadOS hosts.
Software install commands issued to devices without a corresponding operator action in the Fleet audit log.
Repeated authentication attempts from a single source IP iterating over sequential serial numbers or hostnames.

Detection Strategies

Parse Fleet application logs for device API authentications where the presented credential length or format does not match a UUID.
Correlate device API source IP addresses with the expected network ranges of managed Apple endpoints and alert on deviations.
Baseline the volume of device-scoped actions per host and alert when installation or migration commands exceed historical norms.

Monitoring Recommendations

Forward Fleet server logs, reverse proxy access logs, and MDM migration events to a central analytics pipeline.
Monitor for outbound connections from managed Apple devices to MDM servers outside the approved allowlist.
Track changes to the enrolled MDM profile on iOS and iPadOS fleets using existing device inventory tooling.

How to Mitigate CVE-2026-103264

Immediate Actions Required

Upgrade all Fleet server instances to version 4.87.0 or later without delay.
Restrict network access to the Fleet device API so that only managed device network ranges can reach it.
Audit recent device API traffic and MDM migration events for signs of impersonation prior to the upgrade.
Rotate or re-enroll iOS and iPadOS hosts if suspicious device-scoped actions are identified.

Patch Information

Fleetdm addressed the vulnerability in Fleet 4.87.0 by removing hostname and hardware serial acceptance from the device API authentication path. Fixed releases and remediation guidance are documented in GitHub Security Advisory GHSA-vrc8-2wcx-327f.

Workarounds

Place the Fleet device API behind a reverse proxy or VPN that enforces client certificate authentication or source IP allowlisting.
Block device API endpoints from the public internet using firewall or Web Application Firewall rules until the patched version is deployed.
Temporarily disable MDM migration functionality in Fleet if the feature is not actively required.

bash

# Example: restrict Fleet device API exposure at the reverse proxy
# nginx snippet limiting /api/v1/fleet/device to a managed network range
location /api/v1/fleet/device/ {
    allow 10.20.0.0/16;      # managed Apple device subnet
    deny all;
    proxy_pass http://fleet_backend;
}