Critical severity · published Oct 1, 2026
CVE-2026-103264
Fleet before 4.87.0 Authentication Bypass via Device Identifiers
9.1
CVSS
0.3%
EPSS
No
On KEV
Description
Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS hosts to read device data and trigger device-scoped actions including software installation and MDM migration.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
fleet · fleetdm
before 4.87.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-103264
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-103264
vendor-advisory
https://github.com/fleetdm/fleet/security/advisories/GHSA-vrc8-2wcx-327f
third-party-advisory
https://www.vulncheck.com/advisories/fleet-before-4.87.0-authentication-bypass-via-device-identifiers
More from fleet
9.8
CVE-2026-26191
Fleet vulnerable to OS command injection in software packages
9.8
CVE-2026-34387
Fleet vulnerable to OS command injection via crafted software package metadata in uninstall scripts
9.8
CVE-2026-23518
Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment
9.8
CVE-2020-26276
Fleet is an open source osquery manager
9.3
CVE-2025-27509
SAML authentication vulnerability due to improper SAML response validation