Executive brief
Fleet is an open-source platform used for managing and monitoring fleets of laptops, servers, and other devices. A security flaw in how the software identifies users allows attackers to bypass security protections designed to prevent repeated login attempts. This could allow an attacker to perform brute-force or credential-stuffing attacks to gain unauthorized access to the management console, potentially compromising the security of all managed devices.
Technical details
A vulnerability exists in Fleet's IP address extraction logic where the application trusts headers such as 'True-Client-IP', 'X-Real-IP', and 'X-Forwarded-For' without verifying if they originate from a trusted proxy. Because Fleet uses these extracted IP addresses as keys for rate limiting and IP ban decisions, an unauthenticated attacker can rotate these header values in each request. This causes the system to treat each request as originating from a different client, effectively neutralizing rate limits on sensitive endpoints like the login API. The issue is most severe for instances directly exposed to the internet. Version 4.80.1 introduces the 'FLEET_SERVER_TRUSTED_PROXIES' configuration to address this.
Affected products
- Fleet Device Management (fleetdm) Fleet < 4.80.1
Timeline
- 2026-02-06: patched: Version 4.80.1 released with fix.
- 2026-05-13: advisory: GitHub Security Advisory GHSA-mxmp-wr3w-rvqx published.
- 2026-05-14: disclosed: CVE-2026-46356 published to NVD.