Loading...
Skip to main content
GeekWala

CVE-2026-23518 — Vulnerability in github.com/fleetdm/fleet — CVE...

CRITICAL

Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment

Published January 20, 2026Updated February 28, 2026Source: osv

Summary

### Summary A vulnerability in Fleet’s Windows MDM enrollment flow could allow an attacker to submit forged authentication tokens that are not properly validated. Because JWT signatures were not verified, Fleet could accept attacker-controlled identity claims, enabling enrollment of unauthorized devices under arbitrary Azure AD user identities. ### Impact If Windows MDM is enabled, an attacker can enroll rogue devices by submitting a forged JWT containing arbitrary identity claims. Due to missing JWT signature verification, Fleet accepts these claims without validating that the token was issued by Azure AD, allowing enrollment under any Azure AD user identity. ### Patches - 4.78.3 - 4.77.1 - 4.76.2 - 4.75.2 - 4.53.3 ### Workarounds If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM. ### For more information If you have any questions or comments about this advisory: Email us at [security@fleetdm.com](mailto:security@fleetdm.com) Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw) ### Credits We thank @secfox-ai for responsibly reporting this issue.

Advisory Timeline

  • First published January 20, 2026 (265 days ago).
  • Last revised February 28, 2026 — 38 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Go
Update github.com/fleetdm/fleet to 4.43.5-0.20260112202845-e225ef57912c or later
go get github.com/fleetdm/fleet@v4.43.5-0.20260112202845-e225ef57912c
Go
Update github.com/fleetdm/fleet to 4.78.3 or later
go get github.com/fleetdm/fleet@v4.78.3
Go
Update github.com/fleetdm/fleet to 4.77.1 or later
go get github.com/fleetdm/fleet@v4.77.1
Go
Update github.com/fleetdm/fleet to 4.76.2 or later
go get github.com/fleetdm/fleet@v4.76.2
Go
Update github.com/fleetdm/fleet to 4.75.2 or later
go get github.com/fleetdm/fleet@v4.75.2

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (5)

Affects 1 ecosystem: go (1).

PackageEcosystemAffectedFixed In
github.com/fleetdm/fleet
go
All versions4.43.5-0.20260112202845-e225ef57912c
github.com/fleetdm/fleet
go
All versions4.78.3
github.com/fleetdm/fleet
go
All versions4.77.1
github.com/fleetdm/fleet
go
All versions4.76.2
github.com/fleetdm/fleet
go
All versions4.75.2

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-347
    Improper Verification of Cryptographic SignatureMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
—
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

Frequently Asked Questions

What is CVE-2026-23518?
Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2026-23518?
CVE-2026-23518 affects github.com/fleetdm/fleet. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-23518 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-63m5-974w-448v
GO-2026-4335

Related CVEs

  • CVE-2025-27509
    CRITICAL

    Fleet has SAML authentication vulnerability due to improper SAML response validation

  • CVE-2026-107806
    CRITICAL

    Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

  • CVE-2026-68582
    CRITICAL

    Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)

  • CVE-2026-34386
    MEDIUM

    Fleet vulnerable to SQL Injection in MDM bootstrap package by authenticated team or global admin

  • CVE-2026-22808
    MEDIUM

    Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability

More Go Modules advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies