Executive brief
Fleet, an open-source device management platform, is vulnerable to a rate-limiting bypass. Attackers can spoof their source IP address by providing fake information in standard web headers, allowing them to circumvent security protections designed to block repeated login attempts. This increases the risk of successful brute-force or password-spraying attacks against user accounts.
Technical details
Fleet fails to validate client-supplied HTTP headers (X-Forwarded-For, X-Real-IP, and True-Client-IP) when determining the source IP address for incoming requests. An unauthenticated remote attacker can supply arbitrary values in these headers to make each request appear as if it originates from a unique IP address. This effectively bypasses per-IP rate limiting mechanisms, facilitating large-scale brute-force or password-spraying attacks against authentication endpoints. The vulnerability is addressed in version 4.80.1, which introduces the FLEET_SERVER_TRUSTED_PROXIES configuration to properly handle proxy headers.
Affected products
- Fleet Device Management (fleetdm) Fleet < 4.80.1
Timeline
- 2026-02-06: patched: Version 4.80.1 released
- 2026-05-13: disclosed: Initial advisory publication
- 2026-05-14: advisory: GitHub Advisory and CVE published