CVE-2026-23998: Fleet Windows MDM Management Endpoint Authentication Bypass Vulnerability
Summary
CVE-2026-23998: Fleet has a Windows MDM management endpoint authentication bypass. Affects github.com/fleetdm/fleet/v4 versions < 4.81.0. Fixed in 4.81.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fleet is an open-source tool designed for managing and monitoring fleets of devices, particularly in enterprise environments. It utilizes Mobile Device Management (MDM) protocols to ensure that enrolled devices are properly configured and secured. The package relies on mutual TLS (mTLS) client certificates for authenticating enrolled Windows devices, ensuring that only authorized devices can access sensitive configuration data.
Vulnerability Detail
A vulnerability exists in Fleet's Windows MDM management endpoint that allows requests to be processed without proper client certificate validation. This flaw can enable an attacker to impersonate an enrolled Windows device, potentially retrieving sensitive configuration data such as Wi-Fi or VPN settings, certificates, and other secrets. The issue arises from the incorrect handling of requests that do not present a client certificate, which could be mistakenly treated as trusted. While this vulnerability does not allow for the enrollment of new devices or administrative access to Fleet, it poses a significant risk to the security of targeted Windows devices.
How To Fix
Latest published version: v4.43.4 as of 23 Oct 2026
go get github.com/fleetdm/fleet/v4@v4.43.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.81.0
This is the first release that contains the fix.
go get github.com/fleetdm/fleet/v4@v4.81.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, affected users should temporarily disable Windows MDM to mitigate the risk associated with this vulnerability.
Conclusion
The vulnerability identified as CVE-2026-23998 in Fleet's Windows MDM management endpoint poses a significant risk by allowing unauthorized access to sensitive configuration data. Users are strongly advised to update to the patched version 4.81.0 or disable Windows MDM as a temporary measure to mitigate this risk.
See every vulnerability recorded for github.com/fleetdm/fleet/v4 →
FAQ
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
No, this vulnerability does not allow for unauthorized access to the Fleet control plane or the enrollment of new devices.
An attacker could potentially access sensitive configuration data, including Wi-Fi and VPN settings, certificates, and other secrets delivered through MDM profiles.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the Gopkg.lock file, providing an easy way to stay informed about potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/fleetdm/fleet/v4.
