CVE-2026-23518— Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-23518
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment
Source: NVD (National Vulnerability Database)
Vulnerability Description
Fleet is open source device management software. In versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3, a vulnerability in Fleet's Windows MDM enrollment flow could allow an attacker to submit forged authentication tokens that are not properly validated. Because JWT signatures were not verified, Fleet could accept attacker-controlled identity claims, enabling enrollment of unauthorized devices under arbitrary Azure AD user identities. Versions 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 fix the issue. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
密码学签名的验证不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
Fleet 数据伪造问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Fleet是Fleet的一个开源的设备管理平台，支持多种操作系统和设备，帮助 IT 和安全团队进行设备管理、漏洞报告、MDM 等操作，免费且灵活。 Fleet存在数据伪造问题漏洞，该漏洞源于JWT签名未经验证，可能导致攻击者提交伪造的身份验证令牌并注册未经授权的设备。以下版本受到影响：4.78.3之前版本、4.77.1之前版本、4.76.2之前版本、4.75.2之前版本和4.53.3之前版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-23518
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-23518
请登录查看更多情报信息。
Same Patch Batch · fleetdm · 2026-01-21 · 3 CVEs total
| CVE-2026-22808 | Fleet Windows MDM endpoint has a Cross-site Scripting vulnerability | |
| CVE-2026-23517 | Fleet has an Access Control vulnerability in debug/pprof endpoints |
IV. Related Vulnerabilities
Same product: fleet
- CVE-2026-27806
Fleet Affected by Local Privilege Escalation via Tcl Command - CVE-2026-34391
Fleet Vulnerable to Windows MDM cross-device command disclos - CVE-2026-34389
Fleet's user account creation via invite does not enforce in - CVE-2026-34388
Fleet vulnerable to Denial of Service via unhandled gRPC log - CVE-2026-34387
Fleet vulnerable to OS command injection via crafted softwar
Same vendor: fleetdm
- CVE-2026-27806
Fleet Affected by Local Privilege Escalation via Tcl Command - CVE-2026-34391
Fleet Vulnerable to Windows MDM cross-device command disclos - CVE-2026-34389
Fleet's user account creation via invite does not enforce in - CVE-2026-34388
Fleet vulnerable to Denial of Service via unhandled gRPC log - CVE-2026-34387
Fleet vulnerable to OS command injection via crafted softwar
Same weakness: CWE-347
- CVE-2026-42193
Plunk: SNS webhook forgery - CVE-2026-44497
ZEBRA: Consensus Divergence in Transparent Sighash Hash-Type - CVE-2026-41669
Admidio: SAML Signature Validation Result Ignored — Forged A - CVE-2026-7689
Dolibarr ERP CRM Online Signature security.lib.php dol_verif - CVE-2026-33467
Improper Verification of Cryptographic Signature in Elastic
V. Comments for CVE-2026-23518
No comments yet