{"id":"EUVD-2026-30416","revision":"2e0f0d52a5f340c5b6cbc621507c61cd","records":[{"revision":"2e0f0d52a5f340c5b6cbc621507c61cd","observedAt":"2026-10-28T06:13:45.912+00:00","statement":{"source":"euvd","id":"EUVD-2026-30416","aliases":["CVE-2026-46356","GHSA-mxmp-wr3w-rvqx"],"title":"Fleet is open source device management software. Prior to version 4.80.1, a vulnerability in Fleet's IP extraction logic allows unauthenticated attackers to bypass API rate limiting by spoofing client IP headers. This may allow brute-force …","description":"Fleet is open source device management software. Prior to version 4.80.1, a vulnerability in Fleet's IP extraction logic allows unauthenticated attackers to bypass API rate limiting by spoofing client IP headers. This may allow brute-force login attempts or other abuse against Fleet instances exposed to the public internet. Fleet extracted client IP addresses from request headers (`True-Client-IP`, `X-Real-IP`, `X-Forwarded-For`) without validating that those headers originate from a trusted proxy. The extracted IP is used as the key for rate limiting and IP ban decisions. As a result, an attacker could rotate the value of these headers on each request, causing Fleet to treat each attempt as coming from a different client. This effectively bypasses per-IP rate limits on sensitive endpoints such as the login API, enabling unrestricted brute-force or credential stuffing attacks. This issue primarily affects Fleet instances that are directly exposed to the internet without a reverse proxy that overwrites forwarded-IP headers. Instances behind a properly configured proxy or WAF are less affected. Version 4.80.1 contains a patch. If an immediate upgrade is not possible, administrators should ensure Fleet is deployed behind a reverse proxy (e.g., nginx, Cloudflare, AWS ALB) that overwrites `X-Forwarded-For` with the true client IP, and apply rate limiting at the proxy or WAF layer.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.9,"severity":null}],"references":["https://github.com/fleetdm/fleet/security/advisories/GHSA-mxmp-wr3w-rvqx","https://github.com/fleetdm/fleet/releases/tag/fleet-v4.80.1"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30416","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 14, 2026, 7:03:50 PM","dateUpdated":"May 14, 2026, 7:39:08 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-30416","identifiers":["EUVD-2026-30416","CVE-2026-46356","GHSA-mxmp-wr3w-rvqx"]},"retained":false,"historicalAffected":[]}],"coverage":[]}