---
id: GO-2026-6268
aliases:
  - GHSA-q9c5-pp7m-fm2g
title: >-
  Fleet: Unauthenticated download of in-house iOS app binaries via predictable
  URLs in github.com/fleetdm/fleet
summary: >-
  Fleet: Unauthenticated download of in-house iOS app binaries via predictable
  URLs in github.com/fleetdm/fleet
severity: none
vendor: fleetdm
product: github.com/fleetdm/fleet/v4
ecosystem: go
affected:
  - github.com/fleetdm/fleet/v4 < 4.87.0
patched:
  - github.com/fleetdm/fleet/v4 4.87.0
published: '2026-08-25'
updated: '2026-08-26'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GO-2026-6268'
references:
  - url: 'https://github.com/fleetdm/fleet/security/advisories/GHSA-q9c5-pp7m-fm2g'
  - url: 'https://github.com/fleetdm/fleet/releases/tag/fleet-v4.87.0'
tags:
  - osv
  - go
ingestedAt: '2026-08-26T19:27:03.191Z'
---

## Overview

Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs in github.com/fleetdm/fleet

## Affected packages

- `github.com/fleetdm/fleet/v4 < 4.87.0`

## Remediation

Upgrade to a patched release:

- `github.com/fleetdm/fleet/v4 4.87.0`