CVE-2026-23518
unknown
CVSS v3
—
CVSS v2
—
VIR risk
—
Description
Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment in github.com/fleetdm/fleet
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Go | github.com/fleetdm/fleet | >=4.78.0,<4.78.3 | 4.78.3 |
| Go | github.com/fleetdm/fleet | >=4.77.0,<4.77.1 | 4.77.1 |
| Go | github.com/fleetdm/fleet | >=4.76.0,<4.76.2 | 4.76.2 |
| Go | github.com/fleetdm/fleet | >=4.75.0,<4.75.2 | 4.75.2 |
| Go | github.com/fleetdm/fleet | <4.43.5-0.20260112202845-e225ef57912c | 4.43.5-0.20260112202845-e225ef57912c |
| Go | github.com/fleetdm/fleet/v4 | >=4.78.0,<4.78.3 | 4.75.2 |
References
Verify integrity in audit chain (admin only). AS-IS.