GHSA-2rc4-7jc6-qffh: Fleet has a Windows MDM management endpoint authentication bypass
Summary
Fleet, a device management system, had a security flaw in its Windows MDM (mobile device management, a system for controlling and configuring devices) endpoint where requests without proper client certificates (digital credentials proving a device's identity) were incorrectly accepted as trusted. An attacker who knew a valid device's identifier could impersonate that device and receive sensitive configuration data like Wi-Fi passwords or VPN settings intended for the real device.
Solution / Mitigation
If an immediate upgrade is not possible, affected Fleet users should temporarily disable Windows MDM.
Vulnerability Details
EPSS: 0.0%
Yes
May 14, 2026
Classification
Affected Packages
Original source: https://github.com/advisories/GHSA-2rc4-7jc6-qffh
First tracked: May 14, 2026 at 02:00 PM
Classified by LLM (prompt v3) · confidence: 95%