{"id":"EUVD-2026-30373","enisaUuid":"18c79dab-4981-3eb4-979e-18fe47c876e4","description":"Fleet is open source device management software. Prior to version 4.80.1, Fleet trusted client-supplied IP address headers when determining the source IP for incoming requests. This allowed authenticated and unauthenticated clients to spoof their apparent IP address and bypass per-IP rate limiting controls. Fleet determines a client’s public IP address using HTTP headers such as X-Forwarded-For, X-Real-IP, and/or True-Client-IP. These headers were trusted without validation. An attacker could supply arbitrary values in these headers, causing Fleet to treat each request as originating from a different IP address. This could allow an attacker to bypass per-IP rate limits and increase the effectiveness of brute-force or password-spraying attempts against authentication endpoints. This issue does not allow authentication bypass, privilege escalation, data exposure, or remote code execution on its own. Version 4.80.1 contains a patch. As a workaround, run Fleet behind a trusted reverse proxy or load balancer that overwrites client IP headers.","datePublished":"May 14, 2026, 6:56:39 PM","dateUpdated":"May 14, 2026, 7:41:20 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/fleetdm/fleet/security/advisories/GHSA-j8h8-75h3-jg53\nhttps://github.com/fleetdm/fleet/releases/tag/fleet-v4.80.1\n","aliases":"CVE-2026-24000\nGHSA-j8h8-75h3-jg53\n","assigner":"GitHub_M","epss":0.43,"enisaIdProduct":[{"id":"aaf409ed-0777-3ff6-9db1-b74e244303cf","product":{"name":"Fleet","vendor":{"name":"fleetdm"}},"product_version":"\u003c 4.80.1"}],"enisaIdVendor":[{"id":"cf312e4d-2286-3538-ba86-50a0d472e6e7","vendor":{"name":"fleetdm"}}],"enisaIdVulnerability":[{"id":"56051ee9-a350-3af3-9844-02ed19a59c2d","vulnerability":{"id":"CVE-2026-24000","description":"Fleet is open source device management software. Prior to version 4.80.1, Fleet trusted client-supplied IP address headers when determining the source IP for incoming requests. This allowed authenticated and unauthenticated clients to spoof their apparent IP address and bypass per-IP rate limiting controls. Fleet determines a client’s public IP address using HTTP headers such as X-Forwarded-For, X-Real-IP, and/or True-Client-IP. These headers were trusted without validation. An attacker could supply arbitrary values in these headers, causing Fleet to treat each request as originating from a different IP address. This could allow an attacker to bypass per-IP rate limits and increase the effectiveness of brute-force or password-spraying attempts against authentication endpoints. This issue does not allow authentication bypass, privilege escalation, data exposure, or remote code execution on its own. Version 4.80.1 contains a patch. As a workaround, run Fleet behind a trusted reverse proxy or load balancer that overwrites client IP headers.","datePublished":"May 14, 2026, 6:56:39 PM","dateUpdated":"May 14, 2026, 7:41:20 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/fleetdm/fleet/security/advisories/GHSA-j8h8-75h3-jg53\nhttps://github.com/fleetdm/fleet/releases/tag/fleet-v4.80.1\n","enisa_id":"EUVD-2026-30373\n","assigner":"GitHub_M","epss":0.43,"dataProcessed":"Oct 27, 2026, 7:15:28 AM","vulnerabilityProduct":[{"id":"5efc4014-b9e1-37c2-8829-417a28d3903e","product":{"name":"Fleet","vendor":{"name":"fleetdm"}},"product_version":"\u003c 4.80.1"}],"vulnerabilityVendor":[{"id":"dd18a428-52b3-3157-b325-e55e6988753f","vendor":{"name":"fleetdm"}}]}},{"id":"cafa588b-949d-3a3f-bdaf-7bd02b8cbb51","vulnerability":{"id":"GHSA-j8h8-75h3-jg53","description":"Fleet has a rate limiting bypass via untrusted client IP headers","datePublished":"May 14, 2026, 1:13:39 PM","dateUpdated":"May 15, 2026, 11:44:40 PM","baseScore":0.0,"references":"https://github.com/fleetdm/fleet/security/advisories/GHSA-j8h8-75h3-jg53\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-24000\nhttps://github.com/fleetdm/fleet\nhttps://github.com/fleetdm/fleet/releases/tag/fleet-v4.80.1\n","enisa_id":"EUVD-2026-30373\n","aliases":"GHSA-j8h8-75h3-jg53\nCVE-2026-24000\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}