CVE-2026-103265— Fleet before 4.89.0 Information Disclosure via MDM Command Results
Quick assessment
Affected
fleetdm fleet
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 4.89.0 之前的 Fleet 版本中， 端点未能根据团队授权正确过滤 MDM（移动设备管理）命令结果。当共享的命令 UUID 指向多个团队中的主机时，具有团队作用域的用户可以读取其他团队主机的 MDM 命令结果，从而泄露主机 UUID、命令负载及设备响应信息。
Possible ATT&CK Techniques 1 AI
T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-103265
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Fleet before 4.89.0 Information Disclosure via MDM Command Results
Source: CVE Program / CVE List V5
Vulnerability Description
Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results endpoint. Team-scoped users can read MDM command results for hosts on other teams when a shared command UUID targets hosts across multiple teams, exposing host UUIDs, command payloads, and device responses.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-103265
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-103265
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-103265 (2)
IV. Related Vulnerabilities
Same product: fleet
-
CVE-2026-103264
Fleet before 4.87.0 Authentication Bypass via Device Identif -
CVE-2026-101047
Fleet before 4.87.0 Unauthenticated iOS App Download via Pre -
CVE-2026-101046
Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endp -
CVE-2026-101045
Fleet Homebrew Cask OS Command Injection via Metadata -
CVE-2026-75036
Fleet: DNS exfiltration via Sprig getHostByName in fleet.yam
Same vendor: fleetdm
-
CVE-2026-103264
Fleet before 4.87.0 Authentication Bypass via Device Identif -
CVE-2026-101047
Fleet before 4.87.0 Unauthenticated iOS App Download via Pre -
CVE-2026-101046
Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endp -
CVE-2026-101045
Fleet Homebrew Cask OS Command Injection via Metadata -
CVE-2026-54245
Fleet: SQL injection in Okta conditional access endpoint all
Same weakness: CWE-863
-
CVE-2026-103758
Obot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-con -
CVE-2026-103284
Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedb -
CVE-2026-103273
Ghost 4.3.0 before 6.58.0 Incorrect Authorization via Staff -
CVE-2026-103271
Ghost 4.0.0 before 6.63.0 Restricted Content Bypass -
CVE-2026-103266
Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Ac
V. Comments for CVE-2026-103265
No comments yet