{"id":"EUVD-2026-30416","enisaUuid":"664ebcbd-8a0a-3478-919f-38fc93737549","description":"Fleet is open source device management software. Prior to version 4.80.1, a vulnerability in Fleet\u0027s IP extraction logic allows unauthenticated attackers to bypass API rate limiting by spoofing client IP headers. This may allow brute-force login attempts or other abuse against Fleet instances exposed to the public internet. Fleet extracted client IP addresses from request headers (`True-Client-IP`, `X-Real-IP`, `X-Forwarded-For`) without validating that those headers originate from a trusted proxy. The extracted IP is used as the key for rate limiting and IP ban decisions. As a result, an attacker could rotate the value of these headers on each request, causing Fleet to treat each attempt as coming from a different client. This effectively bypasses per-IP rate limits on sensitive endpoints such as the login API, enabling unrestricted brute-force or credential stuffing attacks. This issue primarily affects Fleet instances that are directly exposed to the internet without a reverse proxy that overwrites forwarded-IP headers. Instances behind a properly configured proxy or WAF are less affected. Version 4.80.1 contains a patch. If an immediate upgrade is not possible, administrators should ensure Fleet is deployed behind a reverse proxy (e.g., nginx, Cloudflare, AWS ALB) that overwrites `X-Forwarded-For` with the true client IP, and apply rate limiting at the proxy or WAF layer.","datePublished":"May 14, 2026, 7:03:50 PM","dateUpdated":"May 14, 2026, 7:39:08 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/fleetdm/fleet/security/advisories/GHSA-mxmp-wr3w-rvqx\nhttps://github.com/fleetdm/fleet/releases/tag/fleet-v4.80.1\n","aliases":"CVE-2026-46356\nGHSA-mxmp-wr3w-rvqx\n","assigner":"GitHub_M","epss":0.28,"enisaIdProduct":[{"id":"fcb3d9c9-9f4b-3a20-8a72-683e94ee4d4f","product":{"name":"Fleet","vendor":{"name":"fleetdm"}},"product_version":"\u003c 4.80.1"}],"enisaIdVendor":[{"id":"94613e29-b291-3473-a586-43f2ea0f8c4f","vendor":{"name":"fleetdm"}}],"enisaIdVulnerability":[{"id":"2292fac4-6932-3b08-aebb-8d6a072286be","vulnerability":{"id":"CVE-2026-46356","description":"Fleet is open source device management software. Prior to version 4.80.1, a vulnerability in Fleet\u0027s IP extraction logic allows unauthenticated attackers to bypass API rate limiting by spoofing client IP headers. This may allow brute-force login attempts or other abuse against Fleet instances exposed to the public internet. Fleet extracted client IP addresses from request headers (`True-Client-IP`, `X-Real-IP`, `X-Forwarded-For`) without validating that those headers originate from a trusted proxy. The extracted IP is used as the key for rate limiting and IP ban decisions. As a result, an attacker could rotate the value of these headers on each request, causing Fleet to treat each attempt as coming from a different client. This effectively bypasses per-IP rate limits on sensitive endpoints such as the login API, enabling unrestricted brute-force or credential stuffing attacks. This issue primarily affects Fleet instances that are directly exposed to the internet without a reverse proxy that overwrites forwarded-IP headers. Instances behind a properly configured proxy or WAF are less affected. Version 4.80.1 contains a patch. If an immediate upgrade is not possible, administrators should ensure Fleet is deployed behind a reverse proxy (e.g., nginx, Cloudflare, AWS ALB) that overwrites `X-Forwarded-For` with the true client IP, and apply rate limiting at the proxy or WAF layer.","datePublished":"May 14, 2026, 7:03:50 PM","dateUpdated":"May 14, 2026, 7:39:08 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/fleetdm/fleet/security/advisories/GHSA-mxmp-wr3w-rvqx\nhttps://github.com/fleetdm/fleet/releases/tag/fleet-v4.80.1\n","enisa_id":"EUVD-2026-30416\n","assigner":"GitHub_M","epss":0.28,"dataProcessed":"Oct 28, 2026, 7:17:57 AM","vulnerabilityProduct":[{"id":"5f8298ab-ad67-3927-a33e-8d43b2a00c7d","product":{"name":"Fleet","vendor":{"name":"fleetdm"}},"product_version":"\u003c 4.80.1"}],"vulnerabilityVendor":[{"id":"59aa0317-2605-3d5d-8698-a5f288247324","vendor":{"name":"fleetdm"}}]}},{"id":"788025ea-5b00-338f-b7e4-100568e7f650","vulnerability":{"id":"GHSA-mxmp-wr3w-rvqx","description":"Fleet: IP spoofing allows bypassing API rate limiting","datePublished":"May 14, 2026, 1:18:33 PM","dateUpdated":"May 15, 2026, 11:45:48 PM","baseScore":0.0,"references":"https://github.com/fleetdm/fleet/security/advisories/GHSA-mxmp-wr3w-rvqx\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46356\nhttps://github.com/fleetdm/fleet\nhttps://github.com/fleetdm/fleet/releases/tag/fleet-v4.80.1\n","enisa_id":"EUVD-2026-30416\n","aliases":"GHSA-mxmp-wr3w-rvqx\nCVE-2026-46356\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}