CVE-2026-46356: Fleet Device Management rate limit bypass via IP spoofing

CVE-2026-46356 · Severity: high · CVSS 7.5 · Published 2026-05-14

Fleet is an open-source platform used for managing and monitoring fleets of laptops, servers, and other devices. A security flaw in how the software identifies users allows attackers to bypass security protections designed to prevent repeated login attempts. This could allow an attacker to perform brute-force or credential-stuffing attacks to gain unauthorized access to the management console, potentially compromising the security of all managed devices.

Technologies: github.com/fleetdm/fleet (Go), github.com/fleetdm/fleet/v4 (Go). Vendors: Go.

Quick answers

Is CVE-2026-46356 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-46356 being exploited in the wild.
How severe is CVE-2026-46356?
High severity, with a CVSS score of 7.5, published 14 May 2026.
Which products and versions are affected?
github.com/fleetdm/fleet (Go) < 4.80.1; github.com/fleetdm/fleet/v4 (Go) < 4.80.1, SEMVER:introduced=0,fixed=4.80.1.
Is there a fix for CVE-2026-46356?
Yes. github.com/fleetdm/fleet/v4 (Go): upgrade to 4.80.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46356 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-46356?
Check whether you run github.com/fleetdm/fleet (Go) or github.com/fleetdm/fleet/v4 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/fleetdm/fleet/v4 (Go): upgrade to 4.80.1 or later
    go get github.com/fleetdm/fleet/v4@v4.80.1

Technical details

A vulnerability exists in Fleet's IP address extraction logic where the application trusts headers such as 'True-Client-IP', 'X-Real-IP', and 'X-Forwarded-For' without verifying if they originate from a trusted proxy. Because Fleet uses these extracted IP addresses as keys for rate limiting and IP ban decisions, an unauthenticated attacker can rotate these header values in each request. This causes the system to treat each request as originating from a different client, effectively neutralizing rate limits on sensitive endpoints like the login API. The issue is most severe for instances directly exposed to the internet. Version 4.80.1 introduces the 'FLEET_SERVER_TRUSTED_PROXIES' configuration to address this.

Affected products

  • Fleet Device Management (fleetdm) Fleet < 4.80.1

Identifiers

  • CVE-2026-46356
  • GHSA-mxmp-wr3w-rvqx
  • GO-2026-5520

Timeline

  • 2026-02-06: patched: Version 4.80.1 released with fix.
  • 2026-05-13: advisory: GitHub Security Advisory GHSA-mxmp-wr3w-rvqx published.
  • 2026-05-14: disclosed: CVE-2026-46356 published to NVD.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.