← Vulnerability feed

Vulnerability record · CVE-2026-23998 · published 14 May 2026

CVE-2026-23998: Fleetdm fleet improper certificate validation vulnerability

Fleetdm · Fleet

Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet’s Windows MDM management endpoint could allow requests to be processed without proper client certificate validation. In certain circumstances, this could allow an attacker to impersonate an enrolled Windows device and retrieve sensitive configuration data. Fleet’s Windows MDM management endpoint relies on mutual TLS (mTLS) client certificates to authenticate enrolled devices. In affected versions, requests that did not present a client certificate could be incorrectly treated as trusted. As a result, an attacker with prior knowledge of a valid enrolled device identifier could potentially impersonate that device and receive configuration payloads intended for it. These payloads may contain sensitive information such as Wi-Fi or VPN configuration data, certificates, or other secrets delivered through MDM profiles. This issue does not allow enrollment of new devices, administrative access to Fleet, or compromise of the Fleet control plane. Impact is limited to the targeted Windows device. Version 4.81.0 contains a patch. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.

8.2 CVSS 4.0 High EPSS 0.21% · top 89.4% CWE-295 · Improper certificate validation
8.2CVSS 4.0 base score
0.21%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet’s Windows MDM management endpoint could allow requests to be processed without proper client certificate validation. In certain circumstances, this could allow an attacker to impersonate an enrolled Windows device and retrieve sensitive configuration data. Fleet’s Windows MDM management endpoint relies on mutual TLS (mTLS) client certificates to authenticate enrolled devices. In affected versions, requests that did not present a client certificate could be incorrectly treated as trusted. As a result, an attacker with prior knowledge of a valid enrolled device identifier could potentially impersonate that device and receive configuration payloads intended for it. These payloads may contain sensitive information such as Wi-Fi or VPN configuration data, certificates, or other secrets delivered through MDM profiles. This issue does not allow enrollment of new devices, administrative access to Fleet, or compromise of the Fleet control plane. Impact is limited to the targeted Windows device. Version 4.81.0 contains a patch. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/fleetdm/fleet/releases/tag/fleet-v4.81.0 ProductRelease Notes
https://github.com/fleetdm/fleet/security/advisories/GHSA-2rc4-7jc6-qffh MitigationVendor Advisory

Track CVE-2026-23998 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-26276Fleetdm fleet authentication bypass by spoofing vulnerabilityFleet is an open source osquery manager. In Fleet before version 3.5.1, due to issues in Go's standard library XML parsing, a valid SAML response may…EPSS 2.2%9.3CVE-2026-23518Fleetdm fleet improper verification of cryptographic signature vulnerabilityFleet is open source device management software. In versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3, a vulnerability in Fleet's Windows …EPSS 0.26%8.7CVE-2026-26062Fleetdm fleet improper input validation vulnerabilityFleet is open source device management software. Prior to version 4.81.0, Fleet contained a denial-of-service (DoS) issue in the gRPC Launcher `Publi…EPSS 0.54%8.7CVE-2026-26061Fleetdm fleet allocation without limits vulnerabilityFleet is open source device management software. Prior to 4.81.0, Fleet contained multiple unauthenticated HTTP endpoints that read request bodies wi…EPSS 0.48%8.2CVE-2026-24899Fleetdm fleet authentication bypass by spoofing vulnerabilityFleet is open source device management software. Prior to version 4.82.0, a vulnerability in Fleet's Windows MDM enrollment flow allows authenticatio…EPSS 0.38%8.1CVE-2022-24841Fleetdm fleet improper access control vulnerabilityfleetdm/fleet is an open source device management, built on osquery. All versions of fleet making use of the teams feature are affected by this autho…EPSS 0.85%7.8CVE-2026-27806Fleetdm fleet os command injection vulnerabilityFleet is open source device management software. Prior to 4.81.1, the Orbit agent's FileVault disk encryption key rotation flow on collects a local u…EPSS 0.11%6.9CVE-2026-46356Fleetdm fleet authentication bypass by spoofing vulnerabilityFleet is open source device management software. Prior to version 4.80.1, a vulnerability in Fleet's IP extraction logic allows unauthenticated attac…EPSS 0.39%

Source: NIST National Vulnerability Database (record CVE-2026-23998), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.