CVE-2026-23517
Broken Access Control in Fleet Debug Endpoints Allows DoS
Publication date: 2026-01-21
Last updated on: 2026-02-27
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fleetdm | fleet | to 4.53.3 (exc) |
| fleetdm | fleet | From 4.75.0 (inc) to 4.75.2 (exc) |
| fleetdm | fleet | From 4.76.0 (inc) to 4.76.2 (exc) |
| fleetdm | fleet | 4.77.0 |
| fleetdm | fleet | From 4.78.0 (inc) to 4.78.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a broken access control issue in Fleet, an open source device management software. It allows authenticated users, even those with the lowest privilege level (Observer role), to access debug and profiling endpoints that should be restricted. These endpoints expose sensitive internal server diagnostics, runtime profiling data, and in-memory application state. Additionally, users can trigger CPU-intensive profiling operations through these endpoints.
How can this vulnerability impact me? :
The vulnerability can impact you by allowing low-privilege users to access sensitive server internals and runtime data that they should not see. They can also trigger resource-intensive profiling operations that may lead to denial of service by overloading the server's CPU resources.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if the Fleet debug/pprof endpoints are accessible to low-privilege authenticated users. Specifically, verify if users with the Observer role can access debug or profiling endpoints such as /debug/pprof. Commands to test this could include using curl or similar tools to authenticate as a low-privilege user and attempt to access these endpoints, for example: curl -u observer_user:password http://fleet-server/debug/pprof/. If access is granted, the system is vulnerable.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation steps are to upgrade Fleet to one of the fixed versions: 4.78.3, 4.77.1, 4.76.2, 4.75.2, or 4.53.3. If an immediate upgrade is not possible, you should put the debug/pprof endpoints behind an IP allowlist to restrict access only to trusted IP addresses, preventing low-privilege users from accessing these sensitive endpoints.