Fleet vulnerabilities

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS hosts to read device data and trigger device-scoped actions including software installation and MDM migration.

In Fleet prior to version 4.81.0, metadata from software packages (.pkg, .deb, .rpm, .exe, .msi) is not properly sanitized before being included in generated uninstall scripts. A crafted package with malicious metadata values can cause arbitrary command execution as root (macOS/Linux) or SYSTEM (Windows) on managed endpoints when uninstall is triggered.

Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server memory by sending gzip-compressed request bodies. Attackers can send small, highly compressed requests with Content-Encoding: gzip to unauthenticated endpoints that expand during decoding, crashing the entire Fleet instance.

Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment endpoints, triggering exponential allocation or infinite recursion that exhausts CPU and memory.

A vulnerability has been identified within Fleet where, by default, Fleet will automatically trust a remote server’s certificate when connecting through SSH if the certificate isn’t set in the `known_hosts` file. This could allow the execution of a man-in-the-middle (MitM) attack against Fleet. In case the server that is being connected to has a trusted entry in the known_hosts file, then Fleet will correctly check the authenticity of the presented certificate.

Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results endpoint. Team-scoped users can read MDM command results for hosts on other teams when a shared command UUID targets hosts across multiple teams, exposing host UUIDs, command payloads, and device responses.

Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enterprise tier only) with the intended random, time-limited URL token. Because Apple's InstallEnterpriseApplication MDM command requires these URLs to be reachable without a Fleet session, they cannot rely on session-based authentication, and the missing token allows an unauthenticated attacker with network access to the Fleet server to download in-house IPA binaries and their metadata by guessing sequential title identifiers. The impact is limited to read-only disclosure; there is no privilege escalation or write access, and the free tier is unaffected.

Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities). The deprecated cursor-pagination helper interpolated the sort/order key into the SQL ORDER BY clause without an allowlist, allowing authenticated users with read access to order results by arbitrary columns. Impact is read-only and bounded to columns on the activity_past table not otherwise returned.

Fleet-maintained app install and uninstall scripts for macOS are generated from Homebrew cask metadata. In manifests generated before 2026-08-19, the script generator escaped this metadata at some interpolation sites but not all, allowing cask metadata containing shell metacharacters to be carried into scripts that execute as root. An attacker who could land crafted metadata in an upstream Homebrew cask could achieve arbitrary command execution as root on managed macOS hosts.

A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the management cluster. A user who can supply bundle content to a repository referenced by a GitRepo resource can cause the Fleet controller to disclose cluster metadata and information about hosts reachable from the controller's network position.

Fleet is an open-source device management platform. In versions prior to 4.86.2, the Okta conditional access integration in Fleet Premium is vulnerable to SQL injection through a host-supplied value used in a database query without proper parameterization, allowing an attacker controlling one enrolled host to read or modify arbitrary data in the Fleet database. By disclosing arbitrary database contents, an attacker can extract stored session tokens and replay them to act as a global administrator, and on a managed fleet that administrator access enables running scripts on enrolled hosts, leading to remote code execution.

Fleet up to version 4.84.1 contains a vulnerability in the Apple MDM commands listing endpoint (GET /api/v1/fleet/mdm/apple/commands) that allows an authenticated user with the Observer role to extract sensitive values such as host enrollment secrets and APNs tokens via a sort-order oracle. An attacker can manipulate the order_key parameter and use binary search to reconstruct values character by character. Fixed in version 4.84.2.

Fleet up to version 4.84.1 contains a vulnerability in the labels host-listing endpoint (GET /api/v1/fleet/labels/{id}/hosts) that allows an authenticated user with the Observer role to extract host enrollment secrets via a sort-order oracle. An attacker can manipulate the order_key parameter and reconstruct node_key or orbit_node_key, enabling host impersonation. Fixed in version 4.84.2.

Fleet prior to version 4.87.0 contains a vulnerability in the target search endpoint (POST /api/latest/fleet/targets) that returns unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-class users. Fixed in version 4.87.0.

Fleet prior to version 4.85.0 contains a vulnerability in the global policy read endpoint (GET /api/latest/fleet/policies/{policy_id}) that fails to verify team ownership of the requested policy, allowing an authenticated user with observer-level access on any single team to read the full details of policies belonging to any other team. Fixed in version 4.85.0.

A vulnerability in Fleet allows an attacker with git push access to overwrite Pod Security Standards (PSS) enforcement labels on a target namespace. This occurs because the agent-side deployer does not filter security-sensitive keys from namespaceLabels in fleet.yaml.

In Fleet prior to 4.80.1, the IP extraction logic from headers (`True-Client-IP`, `X-Real-IP`, `X-Forwarded-For`) does not validate that they originate from a trusted proxy. An attacker can rotate these headers to bypass rate limiting and IP bans, enabling brute-force or credential stuffing attacks against the login API.

Fleet prior to 4.81.0 contains a denial-of-service (DoS) issue in the gRPC Launcher PublishLogs endpoint. Certain unexpected input values were not handled gracefully, which could cause the Fleet server process to terminate while processing an authenticated request. An authenticated attacker with access to any enrolled Launcher node key could cause an immediate and complete denial of service with a single gRPC request. Version 4.81.0 contains the patch.

Fleet prior to 4.80.1 trusted client-supplied IP address headers when determining the source IP for incoming requests. Authenticated and unauthenticated clients could spoof their apparent IP address and bypass per-IP rate limiting controls. Version 4.80.1 contains the patch.

In Fleet prior to 4.81.0, the Windows MDM management endpoint could process requests without proper client certificate validation (mTLS). An attacker with knowledge of a valid enrolled device identifier could impersonate that device and retrieve sensitive configuration data such as Wi-Fi, VPN settings, or certificates.

Prior to 4.81.0, Fleet contained an issue in the user invitation flow where the email address provided during invite acceptance was not validated against the email address associated with the invite. An attacker who obtained a valid invite token could create an account under an arbitrary email address while inheriting the role granted by the invite, including global admin. Version 4.81.0 patches the issue.

Fleet is an open source osquery manager. In Fleet before version 3.7.0 a malicious actor with a valid node key can send a badly formatted request that causes the Fleet server to exit, resulting in denial of service. This is possible only while a live query is currently ongoing.