CVE-2026-23998 Fleet has a Windows MDM management endpoint authentication bypass
Attackers can bypass mTLS authentication to impersonate enrolled Windows devices and retrieve sensitive configuration data from Fleet.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23998?
CVE-2026-23998 is a high-severity authentication bypass vulnerability in fleetdm fleet, published on 14 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet’s Windows MDM management endpoint could allow requests to be processed without proper client certificate validation. In certain circumstances, this could allow an attacker to impersonate an enrolled Windows device and retrieve sensitive configuration data. Fleet’s Windows MDM management endpoint relies on mutual TLS (mTLS) client certificates to authenticate enrolled devices. In affected versions, requests that did not present a client certificate could be incorrectly treated as trusted. As a result, an attacker with prior knowledge of a valid enrolled device identifier could potentially impersonate that device and receive configuration payloads intended for it. These payloads may contain sensitive information such as Wi-Fi or VPN configuration data, certificates, or other secrets delivered through MDM profiles. This issue does not allow enrollment of new devices, administrative access to Fleet, or compromise of the Fleet control plane. Impact is limited to the targeted Windows device. Version 4.81.0 contains a patch. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.
Weakness: CWE-295
Which versions are affected by CVE-2026-23998?
3 open source packages ship an affected version, including github.com/fleetdm/fleet/v4. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/fleetdm/fleet/v4 Go | All versions | 4.81.0 |
github.com/fleetdm/fleet/v4 Go | All versions | 4.81.0 |
github.com/fleetdm/fleet/v4 Go | All versions | 4.81.0 |
Products include Fleetdm Fleet.
How do I fix CVE-2026-23998?
Upgrade github.com/fleetdm/fleet/v4 to 4.81.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-23998 being exploited?
There is no known exploitation of CVE-2026-23998 in the wild and no public exploit code.
Other vulnerabilities in fleetdm fleet
- CVE-2020-26276 SAML authentication vulnerability in Fleet
- CVE-2026-103264 Fleet before 4.87.0 Authentication Bypass via Device Identifiers
- CVE-2026-23518 Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment
- CVE-2026-26062 Fleet server may terminate unexpectedly when handling certain gRPC requests
- CVE-2026-26061 Fleet's unbounded request body read allows remote Denial of Service
Sources
Also known as GHSA-2rc4-7jc6-qffh, GO-2026-5002.