CVE-2026-101047 json
Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs
published 2026-08-20 2 mo ago modified 2026-10-07 32 d ago also EUVD-2026-87978 , GHSA-q9c5-pp7m-fm2g , GO-2026-6268
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 15%
- public exploits
- 0
- none known
Summary
Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enterprise tier only) with the intended random, time-limited URL token. Because Apple's InstallEnterpriseApplication MDM command requires these URLs to be reachable without a Fleet session, they cannot rely on session-based authentication, and the missing token allows an unauthenticated attacker with network access to the Fleet server to download in-house IPA binaries and their metadata (bundle identifier, version, and name) by guessing sequential title identifiers. The impact is limited to read-only disclosure; there is no privilege escalation or write access, and the free tier is unaffected (it returns fleet.ErrMissingLicense).
Patch / fix
- go github.com/fleetdm/fleet/v4 4.87.0
- fleetdm fleet 4.87.0
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 39 d ago
Exploit prediction
0.24% chance of exploitation in the next 30 days, higher than 15% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/fleetdm/fleet/v4 | <4.87.0 |
4.87.0 |
Affected products
- fleetdm fleet
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/fleetdm/fleet/security/advisories/GHSA-q9c5-pp7m-fm2g
vendor-advisory, web, mitigation, advisory
-
vulncheck.com
/advisories/fleet-before-4.87.0-unauthenticated-ios-app-download-via-predictable-urls
third-party-advisory
-
github.com
/fleetdm/fleet
package
-
github.com
/fleetdm/fleet/releases/tag/fleet-v4.87.0
web
Sources
- CVE List CVE-2026-101047
- GitHub Advisory GHSA-q9c5-pp7m-fm2g
- NVD CVE-2026-101047
- OSV GO-2026-6268
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.