CVE-2026-23998

Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet’s Windows MDM management endpoint could allow requests to be processed without proper client certificate validation. In certain circumstances, this could allow an attacker to impersonate an enrolled Windows device and retrieve sensitive configuration data. Fleet’s Windows MDM management endpoint relies on mutual TLS (mTLS) client certificates to authenticate enrolled devices. In affected versions, requests that did not present a client certificate could be incorrectly treated as trusted. As a result, an attacker with prior knowledge of a valid enrolled device identifier could potentially impersonate that device and receive configuration payloads intended for it. These payloads may contain sensitive information such as Wi-Fi or VPN configuration data, certificates, or other secrets delivered through MDM profiles. This issue does not allow enrollment of new devices, administrative access to Fleet, or compromise of the Fleet control plane. Impact is limited to the targeted Windows device. Version 4.81.0 contains a patch. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.

• CWE-295

• https://github.com/fleetdm/fleet/releases/tag/fleet-v4.81.0Product, Release Notes
• https://github.com/fleetdm/fleet/security/advisories/GHSA-2rc4-7jc6-qffhMitigation, Vendor Advisory

Published

May 14, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-23990The Flux Operator is a Kubernetes CRD controller that manage…5.3
• CVE-2026-23991go-tuf is a Go implementation of The Update Framework (TUF).…7.5
• CVE-2026-23992go-tuf is a Go implementation of The Update Framework (TUF).…7.5
• CVE-2026-23995EVerest is an EV charging software stack. Prior to version 2…7.8
• CVE-2026-23996FastAPI Api Key provides a backend-agnostic library that pro…3.7
• CVE-2026-23997FacturaScripts is open-source enterprise resource planning a…9
• CVE-2026-23999Fleet is open source device management software. In versions…5.5
• CVE-2026-2400CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Inje…4.3
• CVE-2026-24000Fleet is open source device management software. Prior to ve…5.3
• CVE-2026-24001jsdiff is a JavaScript text differencing implementation. Pri…7.5
• CVE-2026-24002Grist is spreadsheet software using Python as its formula la…9.6
• CVE-2026-24003EVerest is an EV charging software stack. In versions up to …5.3