CVE-2026-101047
mediumPriorität · verfolgen · 21OT-Risiko · erhöhtEPSS 0.002 · 16. PerzentilUSEPSS · bewertet 2026-10-27
Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enterprise tier only) with the intended random, time-limited URL token. Because Apple's InstallEnterpriseApplication MDM command requires these URLs to be reachable without a Fleet session, they cannot rely on session-based authentication, and the missing token allows an unauthenticated attacker with network access to the Fleet server to download in-house IPA binaries and their metadata (bundle identifier, version, and name) by guessing sequential title identifiers. The impact is limited to read-only disclosure; there is no privilege escalation or write access, and the free tier is unaffected (it returns fleet.ErrMissingLicense).
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–medium · 2.7–6.9
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (2)
Betroffene Produkte und Versionsbereiche.
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-q9c5-pp7m-fm2gFleet: Unauthenticated download of in-house iOS app binaries via predictable URLs2026-08-20ghsa · osvUS
### Summary Two endpoints serving in-house iOS application packages and manifests in Fleet's enterprise tier are reachable without a hard-to-guess token in the URL, allowing an unauthenticated attacker who can reach the Fleet server to download an in-house IPA by guessing sequential title identifiers. ### Impact By design, Apple's `InstallEnterpriseApplication` MDM command requires that the manifest URL be reachable by the managed device without a Fleet session, so these endpoints cannot enforce session-based authentication. Fleet's legacy MDM installer path mitigates this by embedding a random, hard-to-guess token in the URL; the in-house iOS app endpoints (added later) were always intended to use the same time-limited-token pattern but the mitigation was not yet in place. The result is read-only disclosure of in-house IPA binaries and their metadata (bundle identifier, version, name) that an operator has deployed through Fleet. This is enterprise-tier only — the free tier returns `fleet.ErrMissingLicense`. There is no privilege escalation, write access, or impact on hosts not managed by Fleet. ### Workarounds If an immediate upgrade is not possible: - Restrict network access to the Fleet server to trusted networks, as is typical for MDM deployments. - Remove in-house iOS apps that contain sensitive material from Fleet; in-house app IPAs are intentionally reachable by managed devices and should not be relied on as a confidential distribution channel. - Where available, configure CloudFront URL signing for software installers to limit the validity window of issued binary URLs. ### For more information If you have any questions or comments about this advisory: Email us at [security@fleetdm.com](mailto:security@fleetdm.com) Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw) ### Credits We thank @offset for responsibly reporting this issue.
- GO-2026-6268Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs in github.com/fleetdm/fleet2026-08-25vendor · osvUS
Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs in github.com/fleetdm/fleet
auch bekannt als (2)
Weitere Namen und Kennungen dieser Entität.
- GHSA-q9c5-pp7m-fm2gosv
- GO-2026-6268osv
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (2) nvd
Externe Belege — Patches, Meldungen, Analysen.
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan