CVE-2026-103265

Executive Summary

CVE-2026-103265 is an authorization bypass (CWE-863) in Fleet, an open-source device management and MDM platform, affecting versions before 4.89.0. The commands/results endpoint fails to properly filter MDM command results by team authorization, allowing a team-scoped user to read MDM command results belonging to hosts on other teams when a shared command UUID targets hosts across multiple teams. Successful exploitation exposes host UUIDs, command payloads, and device responses, constituting a cross-tenant information disclosure with a CVSS base score of 4.3.

Technical Analysis

The vulnerability resides in the MDM command results retrieval logic of Fleet's commands/results endpoint. Fleet organizes managed hosts into "teams," and role-based access control (RBAC) is expected to scope each user's visibility to the hosts and data belonging to their own team(s). The flaw is a failure to enforce that authorization boundary when returning MDM command results.

The core mechanism is a shared command UUID that targets hosts across multiple teams. In MDM workflows, a command is dispatched to one or more hosts and each host returns a result (a device response). When the same command UUID is associated with hosts in several teams, the commands/results endpoint returns results without intersecting the result set against the requesting user's team memberships. As a result, a team-scoped user who legitimately can query results for the command can also receive results generated by hosts outside their authorized team scope.

Because MDM command results are rich artifacts, the exposure includes three distinct classes of sensitive data:

1. Host UUIDs — stable device identifiers that can be used for further targeting and correlation.
2. Command payloads — the content of the MDM command that was issued, which may reveal configuration, profiles, or administrative intent.
3. Device responses — the data returned by managed endpoints, which may contain device state, inventory, or compliance information.

This is a horizontal privilege escalation / broken object-level authorization style issue: the user holds a valid authenticated session and a legitimate role, but the object-level ownership check (which team owns the command result) is missing or incorrectly implemented. It is not an injection, memory-safety, or remote code execution flaw. Exploitation requires network access to the Fleet API, low privileges (an authenticated team-scoped user), no user interaction, and results only in confidentiality impact (C:L) with no integrity or availability impact, which is consistent with the CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N and score 4.3.

The defining exploitability precondition is the shared command UUID spanning multiple teams. Without a UUID that targets hosts across team boundaries, the mis-filtering condition would not produce cross-team data. This makes the issue more likely in environments that: (a) run global/all-team commands, or (b) reuse commands across teams, since these generate the multi-team result sets that the endpoint fails to isolate.

Insufficient technical detail is available in the supplied NVD description to identify the specific function, handler, or database query responsible; no patch diff, commit, or advisory was provided. The analysis above is therefore scoped to the documented flaw class (authorization filtering failure) and the documented data types exposed.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class (broken authorization / CWE-863) and the behavior stated in the NVD description.

1. Reconnaissance / target identification. The attacker requires an authenticated account with a team-scoped role on the Fleet instance. Using that account, the attacker identifies a command UUID that has been issued to hosts across multiple teams (e.g., a command that targeted hosts beyond the attacker's own team). The NVD description explicitly names the relevant endpoint: commands/results.

2. Triggering the flaw class. The attacker queries the commands/results endpoint for the identified shared command UUID. Because the endpoint does not properly filter results by team authorization, the response is not constrained to the requesting user's team. Instead of receiving only results for hosts the user is authorized to see, the attacker receives results associated with hosts on other teams.

3. Payload / execution method. No malicious payload or code execution is required. The "payload" is the crafted API request to commands/results referencing the shared command UUID. Success is measured by the server returning out-of-scope records rather than an authorization error or an empty/redacted result set. This is a read-only abuse of an authenticated API call.

4. Post-exploitation impact. The attacker reads cross-team MDM command results, harvesting host UUIDs, command payloads, and device responses. These artifacts can be used for further reconnaissance, mapping the broader managed fleet, and correlating devices across teams, potentially informing follow-on targeting (e.g., identifying high-value or non-corporate devices). There is no write, modification, or denial-of-service capability described.

Environmental amplifiers: instances that are multi-tenant or that use teams to segregate business units, customers, or managed sub-organizations are most exposed. Environments where commands frequently target hosts across teams are more likely to expose cross-team results. The CVSS PR:L rating confirms that only low-privileged authenticated access is required.

Impact Assessment

The primary impact is confidentiality loss (CVSS C:L). Integrity and availability are unaffected (I:N/A:N), and scope is unchanged (S:U), meaning the compromise stays within the Fleet application's security authority. The attack is network-reachable (AV:N), requires low privileges (PR:L), requires no user interaction (UI:N), and has low attack complexity (AC:L), yielding a base score of 4.3.

Business impact centers on data exposure and trust:

• Cross-team information disclosure breaks the tenant/team isolation model that customers rely on in Fleet deployments. This is a governance and compliance concern for organizations that use teams to separate departments, subsidiaries, customers, or managed clients.
• Exposed host UUIDs are durable identifiers that can be used to track, correlate, and target managed devices. Leaked command payloads and device responses may reveal configuration details, profile contents, or endpoint state that an unauthorized party should not see.
• Blast radius is proportional to how many teams a shared command UUID spans and how many results the endpoint returns without filtering. A single crafted request can potentially surface many out-of-scope records at once, making the disclosure efficient.

Because no integrity or availability impact exists and no public exploit code or active exploitation is reported, the practical severity is driven by the sensitivity of the exposed MDM data in a given environment. Organizations operating Fleet with strict data-separation requirements should treat this as a meaningful access-control defect despite the modest base score.

Detection Guidance

Detection should focus on authorized vs. anomalous access to the commands/results endpoint and on team-scoped users retrieving results for command UUIDs that span teams. No public exploit or IoC data exists, so detections are behavioral and access-pattern based.

Sigma Rule

title: Fleet MDM Cross-Team Command Results Access (CVE-2026-103265)
id: 9f2c6b1a-3d4e-4f7a-9b21-0a1c2d3e4f50
status: experimental
description: Detects a team-scoped user querying the Fleet commands/results endpoint in a way consistent with cross-team MDM command result disclosure.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103265
author: valtersit.com
date: 2026-01-01
tags:
  - attack.t1213
  - cve.2026.103265
logsource:
  category: web
  product: fleet
detection:
  selection_endpoint:
    url|contains:
      - '/commands/results'
  selection_method:
    cs-method: 'GET'
  selection_status:
    sc-status: 200
  condition: selection_endpoint and selection_method and selection_status
fields:
  - c-ip
  - cs-username
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate team-scoped result queries for commands that only target the user's own team
level: medium

YARA Rule

rule CVE_2026_103265_Fleet_Commands_Results_Access
{
    meta:
        description = "Detects Fleet commands/results cross-team access references in web/app logs and artifacts"
        cve = "CVE-2026-103265"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-103265"
    strings:
        $ep = "commands/results" ascii nocase
        $cve = "CVE-2026-103265" ascii
        $team = "team_id" ascii nocase
        $uuid = "command_uuid" ascii nocase
    condition:
        ($ep and ($team or $uuid)) or $cve
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-103265 Possible Fleet MDM Cross-Team Command Results Access"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/commands/results"; nocase; http.uri; content:"command_uuid"; nocase; reference:cve,2026-103265; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-103265; classtype:attempted-recon; sid:2026103265; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [network where network.protocol == "http" and
     http.request.method == "GET" and
     stringContains(url.path, "/commands/results")]
  [network where network.protocol == "http" and
     http.response.status_code == 200 and
     stringContains(url.path, "/commands/results") and
     /* response references a command UUID associated with multiple teams */
     stringContains(http.response.body, "command_uuid")]

Splunk SPL Query

index=web OR index=fleet sourcetype=fleet:api OR sourcetype=access_combined
    ("commands/results")
    (status=200 OR sc_status=200)
| eval endpoint=coalesce(uri_path, url, cs_uri_stem)
| eval user=coalesce(user, cs_username, user_id)
| where like(endpoint, "%commands/results%")
| stats count min(_time) as first_seen max(_time) as last_seen values(endpoint) as endpoints
    by user, src_ip
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="fleet,web,cve-2026-103265">
  <rule id="103265" level="7">
    <decoded_as>json</decoded_as>
    <field name="url">/commands/results</field>
    <field name="method">GET</field>
    <description>CVE-2026-103265: Fleet commands/results accessed - possible cross-team MDM result disclosure</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED, with no patch evidence from any tracked source, no vendor fix recorded, and no listed workarounds. The NVD description states the fix threshold is Fleet 4.89.0; until that upgrade is confirmed available and tested, treat affected instances as unpatched.

1. Immediate mitigations:

   • Restrict the team-scoped roles that can call the commands/results endpoint to only those users who genuinely require MDM result visibility.
   • Audit recent queries to commands/results for access patterns where a team-scoped user retrieved results for command UUIDs spanning multiple teams; review response contents for out-of-scope host UUIDs.
   • Where feasible in the deployment's policy model, reduce the creation of commands that target hosts across multiple teams, since the flaw is triggered by shared multi-team command UUIDs.
   • Monitor and rate-limit API access to the commands/results endpoint per authenticated user.

2. Patch / upgrade steps:

   • Monitor the Fleet project for the 4.89.0 release and its security notes; validate the fix that properly filters MDM command results by team authorization in the commands/results endpoint.
   • Upgrade affected Fleet instances to 4.89.0 or later once available, following the project's standard upgrade procedure.
   • After upgrade, re-test that a team-scoped user can no longer retrieve results for hosts outside their team when querying a shared command UUID.

3. Long-term hardening:

   • Enforce object-level authorization checks (per-team ownership validation) on every result-returning MDM endpoint, treating team membership as an invariant filter rather than an optional one (per CWE-863 remediation guidance).
   • Adopt multi-tenant isolation testing: add regression tests that assert cross-team queries return no foreign records under shared identifiers.
   • Centralize and log all MDM command result retrievals with user, team, command UUID, and returned host UUIDs for continuous monitoring and anomaly detection.
   • Apply least privilege to API tokens and roles; ensure tokens are scoped to a single team wherever multi-team visibility is not required.

References

• NVD — CVE-2026-103265: https://nvd.nist.gov/vuln/detail/CVE-2026-103265
• CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• Fleet project (vendor) releases and security advisories: https://github.com/fleetdm/fleet/releases
• MITRE ATT&CK — T1213 Data from Information Repositories: https://attack.mitre.org/techniques/T1213/
• FIRST EPSS (score not yet published for this CVE at time of writing): https://www.first.org/epss/

Note: No public PoC, exploit code, or Nuclei template was identified; CISA KEV does not list this CVE. No threat actor campaigns or in-the-wild exploitation evidence were provided or found in the supplied data.