{"id":"CVE-2026-101047","aliases":["GHSA-q9c5-pp7m-fm2g","GO-2026-6268"],"url":"https://o3.security/vulnerability/CVE-2026-101047","summary":"Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs","details":"### Summary\n\nTwo endpoints serving in-house iOS application packages and manifests in Fleet's enterprise tier are reachable without a hard-to-guess token in the URL, allowing an unauthenticated attacker who can reach the Fleet server to download an in-house IPA by guessing sequential title identifiers.\n\n### Impact\n\nBy design, Apple's `InstallEnterpriseApplication` MDM command requires that the manifest URL be reachable by the managed device without a Fleet session, so these endpoints cannot enforce session-based authentication. Fleet's legacy MDM installer path mitigates this by embedding a random, hard-to-guess token in the URL; the in-house iOS app endpoints (added later) were always intended to use the same time-limited-token pattern but the mitigation was not yet in place.\n\nThe result is read-only disclosure of in-house IPA binaries and their metadata (bundle identifier, version, name) that an operator has deployed through Fleet. This is enterprise-tier only — the free tier returns `fleet.ErrMissingLicense`. There is no privilege escalation, write access, or impact on hosts not managed by Fleet.\n\n### Workarounds\n\nIf an immediate upgrade is not possible:\n\n- Restrict network access to the Fleet server to trusted networks, as is typical for MDM deployments.\n- Remove in-house iOS apps that contain sensitive material from Fleet; in-house app IPAs are intentionally reachable by managed devices and should not be relied on as a confidential distribution channel.\n- Where available, configure CloudFront URL signing for software installers to limit the validity window of issued binary URLs.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\nEmail us at [security@fleetdm.com](mailto:security@fleetdm.com)\nJoin #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)\n\n### Credits\n\nWe thank @offset for responsibly reporting this issue.","published":"2026-09-27T17:02:35.852Z","modified":"2026-10-02T03:30:37.769834862Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Go","name":"github.com/fleetdm/fleet/v4","fixedVersion":"4.87.0"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101047.json"},{"type":"ADVISORY","url":"https://github.com/fleetdm/fleet/security/advisories/GHSA-q9c5-pp7m-fm2g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101047"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/fleet-before-4.87.0-unauthenticated-ios-app-download-via-predictable-urls"},{"type":"PACKAGE","url":"https://github.com/fleetdm/fleet"},{"type":"WEB","url":"https://github.com/fleetdm/fleet/releases/tag/fleet-v4.87.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-02T03:30:37.769834862Z"}}