CVE-2026-46356
HighSummary
In the Fleet device management software, prior to version 4.80.1, a vulnerability in the IP extraction logic allows unauthenticated attackers to bypass API rate limits by spoofing client IP headers. This may enable brute-force login attempts or other abuses against Fleet instances exposed to the public internet.
Risk Assessment
Organizations may be exposed to brute-force attacks or credential stuffing, potentially leading to unauthorized access to systems. Instances of Fleet without reverse proxy protections are particularly vulnerable.
Recommendation
It is recommended to upgrade to version 4.80.1 or later and implement a reverse proxy to secure Fleet instances against such attacks.
Other vulnerabilities in Fleet device management software
Original NVD description (English source)
Fleet is open source device management software. Prior to version 4.80.1, a vulnerability in Fleet's IP extraction logic allows unauthenticated attackers to bypass API rate limiting by spoofing client IP headers. This may allow brute-force login attempts or other abuse against Fleet instances exposed to the public internet. Fleet extracted client IP addresses from request headers (`True-Client-IP`, `X-Real-IP`, `X-Forwarded-For`) without validating that those headers originate from a trusted proxy. The extracted IP is used as the key for rate limiting and IP ban decisions. As a result, an attacker could rotate the value of these headers on each request, causing Fleet to treat each attempt as coming from a different client. This effectively bypasses per-IP rate limits on sensitive endpoints such as the login API, enabling unrestricted brute-force or credential stuffing attacks. This issue primarily affects Fleet instances that are directly exposed to the internet without a reverse proxy