CVE-2026-103265: Fleet before 4.89.0 Information Disclosure via MDM Command Results
Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results endpoint. Team-scoped users can read MDM command results for hosts on other teams when a shared command UUID targets hosts across multiple teams, exposing host UUIDs, command payloads, and device responses.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Fleetto a version that resolves this vulnerability.Fixed in 4.89.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A team-scoped Fleet user can exploit it if they have access to the MDM command results endpoint and a command UUID is shared across hosts in multiple teams. No user interaction is required.
What information may be exposed?
Affected users may read MDM command results for hosts assigned to other teams. The exposed data can include host UUIDs, command payloads, and device responses.
Are all MDM deployments affected?
The issue applies to Fleet versions before 4.89.0 when an MDM command UUID targets hosts across multiple teams. Deployments without shared command UUIDs spanning teams are not described as exposed by the available information.
How can I determine whether exposure may have occurred?
Review use of the commands/results endpoint by team-scoped users and identify MDM commands with a single UUID targeting hosts in more than one team. Such commands could have allowed those users to retrieve results for hosts outside their authorized team.