CVE-2026-103264

Executive Summary

CVE-2026-103264 is a critical authentication bypass (CWE-287) in Fleet device management server versions before 4.87.0. The device API improperly accepts hostnames and hardware serials — non-secret identifiers — as authentication tokens in addition to legitimate device UUIDs, allowing a remote unauthenticated attacker who knows or can guess these values to impersonate an enrolled iOS/iPadOS host. Successful exploitation yields read access to device data and the ability to trigger device-scoped actions such as software installation and MDM migration, with a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Technical Analysis

The vulnerability resides in Fleet's device-facing API authentication logic. Fleet is an open-source device management platform (osquery-based endpoint visibility plus MDM capabilities). Device clients — including iOS/iPadOS hosts enrolled via MDM — authenticate to the Fleet server to fetch configuration, report status, and execute device-scoped actions.

Per the NVD description, Fleet versions before 4.87.0 accept hostnames and hardware serials as valid authentication tokens in addition to device UUIDs. This is a classic CWE-287 (Improper Authentication) weakness caused by an identity-verification design flaw: the server treats low-entropy, publicly discoverable identifiers as sufficient proof of device identity.

Root-cause characteristics (derived strictly from the description):

• Credential substitution. The authentication mechanism conflates a stable identifier (device UUID — intended as the sole token type) with alternative identifiers (hostname, hardware serial) that were never designed to serve as secrets.
• Non-secret values. Hostnames and hardware serials are routinely exposed in network traffic, asset inventories, MDM enrollment records, support tickets, and even printed on physical device labels. They are not secrets and must never be treated as authenticators.
• No attacker-held credential required. Because the values are guessable (hostnames) or enumerable/obtainable (serials), the effective authentication barrier is near zero.

The attack surface is the network-exposed Fleet server device API. The CVSS vector confirms this: network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), unchanged scope (S:U). The confidentiality and integrity impacts are both High (C:H/I:H) — reads of device data and issuance of device actions — while availability is Not impacted (A:N), consistent with an impersonation flaw that grants standard device-level capabilities rather than a denial-of-service primitive.

No CVE CNA title, affected-version list beyond the "before 4.87.0" statement, OSV package metadata, workaround, or vendor fix reference was supplied in the provided data. The patch confidence is 0/4 (UNPATCHED per tracked sources), meaning no patch evidence was confirmed from any tracked source despite the version threshold stated in the description.

Exploitation Scenarios

All steps below are drawn from the vulnerability class and the explicit facts in the NVD description. No public PoC exists; the attack chain is inferred from the vulnerability class.

1. Reconnaissance / target identification. The attacker identifies a reachable Fleet server (the device API is network-exposed; typical Fleet deployments listen on HTTP/HTTPS service ports). Discovery can be done via internet scanning or internal network enumeration.
2. Identifier acquisition. Because the alternative tokens are hostnames and hardware serials, the attacker collects candidate values through OSINT, network captures, MDM/asset-inventory exposure, DNS records, help-desk data, or simple guessing of predictable hostname conventions. No credential theft is required.
3. Authentication bypass (vulnerability-class trigger). The attacker submits a request to the device API using a hostname or hardware serial as the authentication token in place of a device UUID. The server, in pre-4.87.0 versions, validates that token as if it were a legitimate device identity and establishes a session as the corresponding iOS/iPadOS host.
4. Post-exploitation impact. With an authenticated device session the attacker can (a) read device data associated with the impersonated host, and (b) trigger device-scoped actions, specifically software installation and MDM migration. This enables unauthorized software deployment to the managed device and manipulation of MDM enrollment, potentially redirecting device management to attacker-controlled infrastructure.

Because no exploit code, PoC, or Nuclei template is available, precise request payloads and endpoint paths cannot be stated and are not fabricated here.

Impact Assessment

• Availability (A:N): No direct availability impact; the flaw grants impersonation capability, not resource exhaustion.
• Integrity (I:H): High. The ability to trigger software installation and MDM migration lets an attacker alter the managed device's software state and its management enrollment — a material integrity compromise of both endpoint and MDM control plane.
• Confidentiality (C:H): High. Device data associated with the impersonated host is readable, exposing host details and potentially sensitive endpoint telemetry.
• Scope (S:U): Impact is contained to the device/authorization context; no explicit scope change.
• Blast radius: Every Fleet deployment before 4.87.0 that exposes the device API and enrolls iOS/iPadOS hosts is affected. MDM migration as an action raises the stakes: an attacker able to migrate a device's management could pivot control away from the legitimate organization. The base score of 9.1 reflects unauthenticated, low-complexity, network-reachable exploitation with high confidentiality and integrity loss. EPSS has not been scored by FIRST.org (no value fabricated).

Detection Guidance

Sigma Rule

title: Fleet Device API Authentication Bypass via Hostname or Serial Token
id: 8f2c1a44-9d3b-4c7e-b1a2-7c0e5f6a1b93
status: experimental
description: Detects Fleet device API requests authenticating with a hostname or hardware serial instead of a device UUID, consistent with CVE-2026-103264 (CWE-287).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103264
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: fleet
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/api/v1/fleet/device/'
      - '/api/v1/fleet/device'
  selection_token:
    cs-uri-query|contains:
      - 'token='
      - 'hostname'
      - 'serial'
  filter_uuid:
    cs-uri-query|re: '[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}'
  condition: selection_path and selection_token and not filter_uuid
falsepositives:
  - Legitimate device UUID authentication
level: high

YARA Rule

rule CVE_2026_103264_Fleet_AuthBypass_Token
{
    meta:
        description = "Detects Fleet device API login code paths accepting hostname/serial as authentication tokens before 4.87.0 (CVE-2026-103264)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-103264"
        date = "2026-01-01"
        severity = "critical"
    strings:
        $api = "/api/v1/fleet/device/" ascii wide
        $tok1 = "hostname" ascii wide nocase
        $tok2 = "serial" ascii wide nocase
        $tok3 = "hardware_serial" ascii wide nocase
        $uuid = "device_uuid" ascii wide nocase
    condition:
        ($api and 2 of ($tok1, $tok2, $tok3)) or ($api and $tok1 and not $uuid)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-103264 Fleet Device API Authentication Bypass Attempt"; flow:to_server,established; http.uri; content:"/api/v1/fleet/device/"; http.uri; content:"token="; pcre:"/token=(?![0-9a-fA-F-]{36})[^&]+/R"; classtype:attempted-admin; reference:cve,2026-103264; sid:2026103264; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where network.protocol == "http" and url.path : "/api/v1/fleet/device/*"]
  [network where network.protocol == "http" and url.path : "/api/v1/fleet/device/*" and
    url.query : ("*token=*") and not url.query : "*token=????????-????-????-????-????????????*"]

Splunk SPL Query

index=web sourcetype=fleet_access
| search uri_path IN ("/api/v1/fleet/device/*", "/api/v1/fleet/device")
| rex field=uri_query "token=(?<token>[^&]+)"
| where NOT match(token, "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$")
| stats count values(uri_path) as paths values(token) as tokens by src_ip
| where count > 0

Wazuh OSSEC Rule

<group name="fleet,web,cve-2026-103264,">
  <rule id="103264" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>/api/v1/fleet/device/</url>
    <regex>token=.+</regex>
    <description>CVE-2026-103264: Fleet device API authentication bypass attempt using non-UUID token</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>authentication_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Restrict network access to the Fleet device API to only trusted networks/clients; block direct internet exposure where possible.
   • Where feasible, enforce that only device UUID tokens are accepted at the reverse proxy/WAF layer and reject requests presenting hostname or serial values as tokens.
   • Monitor and alert on any device API authentication using non-UUID token values (see detection rules above).

2. Patch / upgrade steps

   • The NVD description states the affected range is Fleet before 4.87.0. Upgrade to Fleet 4.87.0 or later when available from the vendor.
   • Because patch confidence is 0/4 (no patch evidence from tracked sources), validate the fix through the vendor's release notes and confirm the device API no longer accepts hostnames or serials as authentication tokens before considering the system remediated.

3. Long-term hardening

   • Never treat hostnames or hardware serials as authentication secrets. Enforce cryptographically strong, secret device credentials (e.g., device UUID combined with a server-issued secret, or mTLS) for all device authentication.
   • Apply the principle that identifiers are public and authenticators are secret; audit all authentication code paths for similar identifier-as-token conflation.
   • Reduce enumeration exposure of device identifiers in assets, inventories, and logs.

References

• NVD — CVE-2026-103264: https://nvd.nist.gov/vuln/detail/CVE-2026-103264
• Fleet (vendor) — product and release information: https://fleetdm.com/
• Fleet GitHub releases (verify fixed version 4.87.0): https://github.com/fleetdm/fleet/releases
• CWE-287 — Improper Authentication: https://cwe.mitre.org/data/definitions/287.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

No known threat actor campaigns or exploit-in-the-wild evidence were provided in the source data; no public PoC or exploit code is known, and the CVE is not listed in CISA KEV.