CVE-2026-101047

Executive Summary

CVE-2026-101047 is a missing-authorization vulnerability (CWE-862) in Fleet versions before 4.87.0 affecting the enterprise tier only. Two endpoints that serve in-house iOS application packages (IPA binaries) and their manifests are not protected by the intended random, time-limited URL token, because Apple's InstallEnterpriseApplication MDM command requires those URLs to be reachable without a Fleet session. An unauthenticated attacker with network access to the Fleet server can download in-house IPA binaries and metadata (bundle identifier, version, and name) by guessing sequential title identifiers. The impact is read-only information disclosure with no privilege escalation or write access; the free tier is unaffected.

Technical Analysis

Fleet is an open-source device management platform used to manage macOS, Windows, Linux, and mobile endpoints, including iOS devices via MDM. In the enterprise tier, Fleet can host and distribute in-house iOS applications. Distribution of these applications relies on Apple's InstallEnterpriseApplication MDM command, which instructs a managed device to fetch an application manifest (a .plist describing the IPA location and metadata) and then fetch the IPA binary itself from URLs embedded in that manifest.

Because the MDM command is executed by the device outside of an interactive Fleet user session, the two endpoints serving the manifest and the IPA cannot rely on session-based authentication — the device simply issues HTTP requests to the URLs provided in the command. To compensate, the intended design uses a random, time-limited URL token embedded in the URL so that only parties who received the command (and thus the tokenized URL) can retrieve the artifacts. In affected versions, the endpoints fail to perform that intended token check, resulting in missing authorization.

The root cause class is CWE-862 (Missing Authorization): an access-control check that should exist does not. Because the resource identifiers are sequential title identifiers rather than unguessable values, an attacker who can reach the Fleet server can enumerate identifiers and retrieve artifacts for which they have no authorization. The exposed data is limited to the IPA binary and its metadata — bundle identifier, version, and name — constituting a confidentiality-only impact.

The vulnerability is scoped as follows:

• Tier: Enterprise only. The free tier is explicitly unaffected; requests return fleet.ErrMissingLicense, meaning the feature is license-gated and does not serve artifacts without a valid enterprise license.
• Authentication required: None. The flaw is reachable unauthenticated, which matches the CVSS vector PR:N.
• Attack complexity: Low; identifiers are sequential and therefore trivially enumerable (AC:L).
• Scope: Unchanged (S:U) — the vulnerable component and impacted component are the same.
• Integrity/Availability: No impact (I:N, A:N) — the mechanism is read-only artifact retrieval.
• Confidentiality: Low (C:L) — disclosure is limited to in-house iOS application artifacts and associated metadata.

Note that Federated/SSO, session, and API-token protections are bypassed by design for these two endpoints, since the MDM workflow mandates unauthenticated reachability. That design constraint is precisely why the random time-limited token was intended as the sole access control — and why its absence is a complete authorization failure for these resources rather than a defense-in-depth gap.

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE. The mechanism described above is derived from the NVD description; no additional implementation details (specific handler names, route paths, or parameter names) are asserted because they are not provided in the source data.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class and the NVD description. No public PoC exists; steps are described at the vulnerability-class level.

1. Reconnaissance / target identification. An attacker identifies a reachable Fleet server, typically one exposed to the internet or reachable from an adjacent network segment. Fleet servers can be fingerprinted by their web UI and MDM-related endpoints. The attacker confirms the instance is enterprise tier (e.g., by observing enterprise features or, indirectly, by responses that do not return the free-tier fleet.ErrMissingLicense behavior for the relevant artifact-serving endpoints).

2. Triggering the flaw. The two endpoints that serve in-house iOS application packages and manifests are reachable without a Fleet session. The intended random, time-limited URL token is not enforced. The attacker therefore constructs requests directly to these endpoints without any token or session credential.

3. Enumeration / payload retrieval. Because the endpoints use sequential title identifiers, the attacker iterates identifiers (e.g., incrementing integer or sequential title values) and issues unauthenticated HTTP requests. For each identifier that corresponds to an existing in-house iOS application, the server returns the manifest and/or the IPA binary. No authentication bypass technique, injection, or memory corruption is required — the authorization check is simply absent.

4. Post-exploitation impact. The attacker obtains in-house IPA binaries and metadata: bundle identifier, version, and name. This enables offline analysis and reverse engineering of proprietary or internal iOS applications, discovery of embedded configuration, endpoints, API keys, or signing details that may be present in the binary, and inventorying of an organization's internal mobile application catalog. Per the description, the impact is limited to read-only disclosure; there is no privilege escalation and no write access.

Because no authentication is required and identifiers are sequential, exploitation is repeatable and low-noise; an attacker can harvest all available artifacts in a single enumeration pass. The absence of write access means no direct modification of Fleet configuration or managed devices is possible via this flaw.

Impact Assessment

CVE-2026-101047 has a CVSS v3.1 base score of 5.3 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Subscore interpretation:

• AV:N (Network): The vulnerable endpoints are reachable over the network; no local access is needed.
• AC:L (Low): No special conditions, race conditions, or elevated complexity are required. Sequential identifiers make enumeration trivial.
• PR:N (None): No credentials, session, or token are needed — this is the core defect.
• UI:N (None): No user interaction is required on the part of a victim.
• S:U (Unchanged): The exploited component and the impacted component are the same.
• C:L (Low): Confidentiality impact is limited to in-house iOS application artifacts and their metadata (bundle identifier, version, name). This is scoped information, not broad system data, hence Low rather than High.
• I:N / A:N: The flaw provides read-only access; there is no ability to modify or disrupt the platform or managed devices.

Business impact. Affected organizations are enterprise-tier Fleet customers who distribute in-house iOS applications. Disclosure of IPA binaries can expose proprietary code, internal APIs, embedded secrets or configuration, and the existence and versioning of internal mobile applications. This supports adversary reconnaissance and reverse engineering but does not by itself grant device control, code execution, or data modification. The free tier is unaffected, and the enterprise price/licensing model limits the exposed population.

Blast radius. Any Fleet server (enterprise tier, version < 4.87.0) that is network-reachable by an attacker and hosts in-house iOS applications is in scope. Exposure is bounded by network reachability and by whether the instance actually serves enterprise iOS artifacts. Because exploitation is unauthenticated, the effective blast radius expands for internet-exposed instances.

There is no CISA KEV listing, no confirmed exploit-in-the-wild evidence, and the EPSS score has not been published by FIRST.org at the time of writing. The vulnerability is not currently associated with known ransomware or APT campaigns.

Detection Guidance

Sigma Rule

This rule detects unauthenticated, high-volume access to the iOS application artifact-serving endpoints by monitoring web server access logs for requests lacking authentication context and exhibiting sequential identifier patterns. Because specific endpoint paths are not disclosed in the source data, the rule keys on the artifact file types and burst patterns.

title: Fleet iOS Application Artifact Enumeration (CVE-2026-101047)
id: 7c1e5a2b-3f4d-4a9e-9b21-0f6a8d2c4e10
status: experimental
description: Detects sequential, unauthenticated requests for iOS in-house IPA binaries and manifests served by Fleet enterprise endpoints (CVE-2026-101047).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101047
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: generic
detection:
  selection_artifact:
    cs-uri-stem|endswith:
      - '.ipa'
      - '.plist'
  selection_manifest:
    cs-uri-query|contains:
      - 'manifest'
      - 'ios'
  selection_no_auth:
    cs-uri-query|notcontains:
      - 'token='
      - 'session='
    cs-cookie|notcontains:
      - 'fleet_session'
  condition: (selection_artifact or selection_manifest) and selection_no_auth
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate MDM-managed iOS devices fetching manifests with tokens
  - Monitoring or inventory tooling with authorized tokens
level: medium

YARA Rule

This rule detects Fleet iOS application artifact files and manifest content characteristic of the enterprise distribution flow. It is intended for scanning retained artifacts or host files for the data types disclosed by this CVE.

rule Fleet_iOS_Enterprise_Artifact_CVE_2026_101047
{
    meta:
        description = "Detects Fleet enterprise iOS in-house application artifacts and manifests relevant to CVE-2026-101047"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101047"
        severity = "medium"

    strings:
        $mdm1 = "InstallEnterpriseApplication" ascii wide
        $mdm2 = "com.apple.mdm" ascii wide
        $plist = "<?xml" ascii
        $ipa1 = "Payload" ascii
        $ipa2 = "CFBundleIdentifier" ascii wide
        $ipa3 = "CFBundleShortVersionString" ascii wide
        $ipa4 = "CFBundleName" ascii wide
        $manifest = "items" ascii wide

    condition:
        uint32(0) == 0x504b0304 and
        filesize < 200MB and
        (2 of ($ipa*) or (2 of ($plist, $manifest, $mdm1, $mdm2)))
}

Suricata IDS Rule

This rule alerts on sequential, unauthenticated HTTP access to Fleet iOS artifact/manifest endpoints, indicated by artifact file extensions and the absence of token parameters.

alert http any any -> any any (msg:"CVE-2026-101047 Fleet iOS Artifact Authorization Bypass Enumeration Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".ipa"; nocase; http.uri; content:".plist"; nocase; pcre:"/\.(ipa|plist)(\?|$)/Ui"; http.uri; content:"token"; negate; nocase; threshold: type both, track by_src, count 15, seconds 60; classtype:attempted-recon; reference:cve,2026-101047; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-101047; sid:2026101047; rev:1;)

Elastic Detection

This EQL rule correlates web access events showing repeated requests to iOS artifact endpoints from a single source without authentication tokens, consistent with sequential identifier enumeration.

sequence by source.ip with maxspan=2m
  [ network where network.protocol == "http" and
      http.request.method == "GET" and
      (endsWith(to_lower(url.path), ".ipa") or endsWith(to_lower(url.path), ".plist")) and
      not wildcard(url.query, "*token=*") and
      not wildcard(url.query, "*session=*") ]
  [ network where network.protocol == "http" and
      http.request.method == "GET" and
      (endsWith(to_lower(url.path), ".ipa") or endsWith(to_lower(url.path), ".plist")) and
      not wildcard(url.query, "*token=*") ]

Splunk SPL Query

This query identifies sources making many unauthenticated artifact requests within a short window, which is characteristic of identifier enumeration against the vulnerable endpoints.

index=web
(
  uri_path="*.ipa" OR uri_path="*.plist"
  OR uri_query="*manifest*"
  OR uri_query="*ios*"
)
(NOT uri_query="*token=*")
(NOT cookie="*fleet_session*")
| stats count AS request_count,
        dc(uri_path) AS distinct_paths,
        values(status) AS status_codes,
        earliest(_time) AS first_seen,
        latest(_time) AS last_seen
        BY src_ip
| where request_count > 20 AND distinct_paths > 5
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"),
       last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - request_count

Wazuh OSSEC Rule

This Wazuh rule detects web server log entries indicating high-volume unauthenticated access to iOS artifact endpoints (.ipa/.plist) without token parameters, mapped to CVE-2026-101047.

<group name="web,accesslog,fleet,cve-2026-101047">
  <rule id="202610" level="10" frequency="15" timeframe="60">
    <if_matched_sid>31101</if_matched_sid>
    <match>GET</match>
    <regex type="pcre2">\.(ipa|plist)(\?|$|\s)</regex>
    <regex type="pcre2" negate="yes">token=</regex>
    <description>CVE-2026-101047: Possible Fleet iOS artifact authorization-bypass enumeration (repeated unauthenticated .ipa/.plist requests)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_101047,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version data was provided by tracked sources beyond the NVD description's stated fixed version.

1) Immediate mitigations (interim, configuration/network-level):

• Restrict network access to the Fleet server. Place the Fleet server behind a reverse proxy, VPN, or allowlist, and avoid exposing it directly to the internet. Restricting reachability removes the AV:N precondition that makes the flaw exploitable by unauthenticated remote parties.
• Where feasible, block or tightly scope external access to iOS artifact/manifest-serving paths at the reverse proxy or WAF. Since the affected endpoints are enterprise-only and intended to be reached only via tokenized URLs issued through Apple's InstallEnterpriseApplication flow, filtering requests that lack the expected token format can reduce exposure.
• Disable or avoid deploying the enterprise in-house iOS application distribution feature where it is not operationally required, to eliminate the exposed endpoints entirely.
• Increase logging and monitoring of the two artifact endpoints and alert on unauthenticated access, particularly sequential enumeration patterns, per the Detection Guidance above.

2) Patch / upgrade steps:

• Upgrade Fleet to 4.87.0 or later, which is the fixed version cited in the NVD description. Given the 0/4 patch confidence, verify the release notes and confirm the fix for the missing-token check prior to relying on the upgrade as a complete remediation.
• After upgrading, validate that the artifact endpoints require the intended random, time-limited URL token and that unauthenticated requests are rejected.
• Rotate or invalidate any in-house iOS application artifacts (IPAs) and manifests that may have been exposed, and review associated metadata for sensitive content.

3) Long-term hardening:

• Enforce server-side authorization checks on every artifact- and manifest-serving endpoint, and treat MDM-mandated unauthenticated reachability as a case requiring an unguessable capability token (random, time-limited) as the primary access control.
• Replace sequential resource identifiers with non-guessable identifiers where the resource is retrievable without a session, to remove enumeration as an attack primitive.
• Adopt a general design rule: any endpoint intentionally reachable without a Fleet session must carry its own authorization mechanism; ensure this is enforced in code review and tested in automated security tests.
• Maintain inventory and monitoring of all unauthenticated (sessionless) endpoints in the Fleet deployment and review them regularly.
• Subscribe to Fleet security advisories and monitor the NVD entry for CVE-2026-101047 for updated patch information, as no fix details are currently confirmed by tracked sources.

References

• NVD — CVE-2026-101047: https://nvd.nist.gov/vuln/detail/CVE-2026-101047
• CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
• Apple Developer Documentation — InstallEnterpriseApplication MDM command (device management protocol reference)
• Fleet documentation and release notes (verify the 4.87.0 fixed release): https://github.com/fleetdm/fleet/releases
• FIRST.org EPSS — no score published for CVE-2026-101047 at the time of writing (do not cite a numeric EPSS value).

Threat actor / exploit-in-the-wild evidence: none. There is no CISA KEV listing, no public proof-of-concept, no exploit code, and no Nuclei template associated with CVE-2026-101047 as of this report. No known campaigns are linked to this vulnerability.