CVE-2026-103264Critical· 9.1▾ MidnightFleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess t…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS hosts to read device data and trigger device-scoped actions including software installation and MDM migration.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-103265Medium· 4.3Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results endpoint
CVE-2026-88808High· 8.8A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment
CVE-2026-93538High· 7.1A cross-tenant authorization issue was discovered in SUSE Rancher Fleet
CVE-2026-93539Medium· 5.4A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service)
CVE-2026-93540Medium· 6.5A privilege mismatch was found in Fleet
CVE-2026-93537Medium· 6.5A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesyst…