CVE-2026-103265: Fleetdm Fleet Information Disclosure

CVE-2026-103265 Overview

CVE-2026-103265 is an authorization flaw in Fleet, the open-source device management platform from Fleetdm. Versions before 4.89.0 fail to enforce team-based authorization on the MDM commands/results endpoint. Team-scoped users can read Mobile Device Management (MDM) command results for hosts outside their assigned teams when a shared command Universally Unique Identifier (UUID) targets hosts across multiple teams. The exposed data includes host UUIDs, command payloads, and device responses. The weakness is classified as CWE-863: Incorrect Authorization.

Critical Impact
Low-privileged team users can retrieve MDM command results for hosts belonging to other teams, breaking multi-tenant isolation and disclosing device metadata and payloads.

Affected Products

Fleetdm Fleet versions prior to 4.89.0
Fleet deployments using MDM functionality with team-based scoping
Multi-tenant Fleet instances relying on team authorization boundaries

Discovery Timeline

2026-10-01 - CVE-2026-103265 published to the National Vulnerability Database (NVD)
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2026-103265

Vulnerability Analysis

Fleet implements team-based Role-Based Access Control (RBAC) to isolate device data between tenants. The commands/results endpoint returns results for an MDM command identified by its UUID. In vulnerable versions, the endpoint resolves results by command UUID without re-filtering the returned rows against the caller's team membership.

When a single MDM command UUID is dispatched against hosts spanning multiple teams, every team-scoped user with access to any subset of those hosts can retrieve all results. This exposes host UUIDs, the raw command payload sent to devices, and each device's response. The disclosed material can include MDM profile contents, configuration directives, and device state information useful for follow-on reconnaissance.

Root Cause

The root cause is a missing authorization check on the query path serving commands/results. Fleet retrieves results keyed by command UUID but does not intersect those results with the caller's team scope. This is a classic [CWE-863] violation where authentication succeeds, a coarse permission check passes, but fine-grained object-level authorization is not enforced on the response set.

Attack Vector

Exploitation requires an authenticated Fleet account with low privileges on at least one team. The attacker queries the MDM commands/results API with a command UUID known or guessed to have been issued across multiple teams. The server returns all rows matching that UUID, including those owned by teams the caller cannot access. No user interaction and no elevated privileges are required. See the GitHub Security Advisory GHSA-97fg-h5wh-2399 and the VulnCheck advisory for technical details.

Detection Methods for CVE-2026-103265

Indicators of Compromise

Repeated authenticated requests to the MDM commands/results endpoint from a single team-scoped user referencing many distinct command UUIDs.
API access patterns where a user retrieves results for host UUIDs that do not appear in that user's assigned team inventory.
Audit log entries showing successful 200 OK responses to commands/results queries by non-admin accounts shortly after MDM command dispatch.

Detection Strategies

Correlate Fleet application logs with team membership data to flag any response containing host UUIDs outside the requester's authorized team scope.
Baseline normal commands/results query volume per user and alert on sudden enumeration of command UUIDs.
Review MDM command dispatch records for UUIDs that span multiple teams and audit which accounts subsequently queried those UUIDs.

Monitoring Recommendations

Forward Fleet API logs and audit events to a centralized Security Information and Event Management (SIEM) platform for cross-team access analytics.
Enable verbose logging on the Fleet MDM endpoints during the upgrade window to capture suspicious historical queries.
Monitor for unusual API token usage patterns associated with observer or team-scoped maintainer roles.

How to Mitigate CVE-2026-103265

Immediate Actions Required

Upgrade all Fleet instances to version 4.89.0 or later without delay.
Rotate Fleet API tokens for team-scoped users that may have accessed the vulnerable endpoint.
Audit historical access to commands/results and identify any cross-team disclosure events.

Patch Information

Fleetdm addressed the authorization gap in Fleet 4.89.0. The fix enforces team-based filtering on MDM command results so that users only receive rows for hosts within their authorized team scope. Full details are published in the GitHub Security Advisory GHSA-97fg-h5wh-2399.

Workarounds

Restrict access to the Fleet web UI and API to administrators until the upgrade to 4.89.0 is completed.
Avoid dispatching MDM commands with shared UUIDs that target hosts across multiple teams.
Place Fleet behind a reverse proxy that enforces additional request-level allowlists for the commands/results endpoint.

bash

# Upgrade Fleet to the fixed release
fleetctl --version
# Pull and deploy Fleet 4.89.0 or later
docker pull fleetdm/fleet:v4.89.0
docker stop fleet && docker rm fleet
docker run -d --name fleet \
  -p 8080:8080 \
  --env-file /etc/fleet/fleet.env \
  fleetdm/fleet:v4.89.0