IP Address Spoofing Vulnerability in Fleet Device Management Software by FleetDM

CVE-2026-24000

What is CVE-2026-24000?

Fleet, an open-source device management software, has a vulnerability that allows both authenticated and unauthenticated users to spoof their apparent IP address by manipulating HTTP headers like X-Forwarded-For, X-Real-IP, and True-Client-IP. This trust in client-supplied IP address headers without adequate validation enables attackers to bypass per-IP rate limiting controls, potentially enhancing the success of brute-force and password-spraying attacks on authentication endpoints. While this vulnerability does not directly lead to authentication bypass, privilege escalation, data exposure, or remote code execution, it represents a significant risk to the integrity of rate limiting mechanisms. Fleet version 4.80.1 addresses this issue, and it is recommended to run Fleet behind a trusted reverse proxy or load balancer to mitigate the risk.

References