CVE-2026-103264

EUVD-2026-90658
Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS hosts to read device data and trigger device-scoped actions including software installation and MDM migration.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
fleetdmfleet
𝑥
< 4.87.0
CNA
Common Weakness Enumeration
References
https://github.com/fleetdm/fleet/security/advisories/GHSA-vrc8-2wcx-327f
https://www.vulncheck.com/advisories/fleet-before-4.87.0-authentication-bypass-via-device-identifiers