CVE-2026-103264: Fleet before 4.87.0 Authentication Bypass via Device Identifiers
Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS hosts to read device data and trigger device-scoped actions including software installation and MDM migration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fleetto a version that resolves this vulnerability.Fixed in 4.87.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Fleet versions before 4.87.0 are affected. The exposed API behavior applies to authentication as iOS/iPadOS hosts.
What does an attacker need to exploit this issue?
An attacker does not need prior authentication or user interaction. They need to know or guess a target device's hostname or hardware serial, which the affected API accepts as an authentication token.
What could an attacker do after bypassing authentication?
An attacker can read device data and invoke device-scoped actions as the targeted iOS/iPadOS host. Documented actions include software installation and MDM migration.