PT-2026-40968 · Fleet · Fleet

Fuzzztf · Published 2026-05-14 · Updated 2026-06-25 · CVE-2026-24000

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.80.1

Description Fleet trusted client-supplied IP address headers when determining the source IP for incoming requests. This allowed authenticated and unauthenticated clients to spoof their apparent IP address and bypass per-IP rate limiting controls. The software determines a client’s public IP address using HTTP headers such as "X-Forwarded-For", "X-Real-IP", and "True-Client-IP", which were trusted without validation. An attacker could supply arbitrary values in these headers, causing the system to treat each request as originating from a different IP address, thereby increasing the effectiveness of brute-force or password-spraying attempts against authentication endpoints.

Recommendations Update to version 4.80.1. Run Fleet behind a trusted reverse proxy or load balancer that overwrites client IP headers.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2026-24000

GHSA-J8H8-75H3-JG53

GO-2026-5455

Affected Products

Fleet

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24000.json · Exploit
• https://github.com/fleetdm/fleet/security/advisories/GHSA-j8h8-75h3-jg53 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24000 · Security Note
• https://osv.dev/vulnerability/GO-2026-5455 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24000 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j8h8-75h3-jg53 · Vendor Advisory
• https://github.com/fleetdm/fleet · Note
• https://github.com/fleetdm/fleet/releases/tag/fleet-v4.80.1 · Note