Executive brief
Fleet is an open-source platform used by IT and security teams to manage and monitor laptops and servers. A security flaw in the Windows device enrollment process allows unauthorized users to bypass authentication by using identity tokens from any Microsoft Azure AD account, not just the one belonging to the organization. This could allow an attacker to enroll unauthorized devices into the company's management system and potentially access sensitive configuration secrets.
Technical details
An authentication bypass exists in Fleet's Windows MDM enrollment flow prior to version 4.82.0. While Fleet validates JSON Web Token (JWT) signatures using Microsoft's multi-tenant JWKS endpoint, it fails to enforce the 'aud' (audience) or 'iss' (issuer) claims. Consequently, any valid Microsoft-signed Azure AD access token with the required scopes can be used to authenticate to Fleet's MDM endpoints. An attacker can exploit this to enroll rogue devices or interact with MDM management APIs, potentially exposing sensitive enrollment secrets within MDM command payloads. The issue is resolved in version 4.82.0 by allowing administrators to specify allowed Entra (Azure AD) tenant IDs.
Affected products
- Fleet Device Management (fleetdm) Fleet < 4.82.0
Timeline
- 2026-03-12: patched: Version 4.82.0 released
- 2026-05-13: advisory: Vendor security advisory published
- 2026-05-14: disclosed: CVE published to NVD