CVE-2026-101047
Received Received - Intake

Fleet Server Unauthenticated IPA Package Download

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulnCheck

Description
Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enterprise tier only) with the intended random, time-limited URL token. Because Apple's InstallEnterpriseApplication MDM command requires these URLs to be reachable without a Fleet session, they cannot rely on session-based authentication, and the missing token allows an unauthenticated attacker with network access to the Fleet server to download in-house IPA binaries and their metadata (bundle identifier, version, and name) by guessing sequential title identifiers. The impact is limited to read-only disclosure; there is no privilege escalation or write access, and the free tier is unaffected (it returns fleet.ErrMissingLicense).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-101047
EUVD
EUVD-2026-87978

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
fleetdm fleet to 4.87.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-101047 affects Fleet software versions before 4.87.0. It involves two endpoints that serve in-house iOS application packages and manifests without proper token-based protection. Attackers with network access can guess sequential identifiers to download IPA binaries and metadata like bundle identifiers, versions, and app names without authentication. The impact is limited to read-only disclosure and only affects the enterprise tier.

Detection Guidance

Check Fleet server logs for repeated access attempts to the two endpoints serving iOS app packages and manifests. Look for sequential title identifier patterns in URLs. Use network monitoring tools to detect unauthorized downloads of IPA files or metadata from these endpoints.

Impact Analysis

An attacker could download sensitive in-house iOS app binaries and metadata from your Fleet server if you use the enterprise tier and are running a version before 4.87.0. This exposes app details like bundle identifiers and versions, but does not allow privilege escalation or write access. The free tier is unaffected.

Compliance Impact

This vulnerability could lead to unauthorized access and disclosure of sensitive application data, which may violate compliance requirements under GDPR or HIPAA depending on the nature of the exposed data. Unauthorized access to IPA binaries and metadata could constitute a data breach if the apps contain or reference protected information.

Mitigation Strategies
  • Upgrade Fleet to version 4.87.0 or later to address the missing authorization issue.
  • Restrict network access to the vulnerable endpoints to trusted sources only.
  • Remove sensitive in-house iOS apps from the Fleet server if no longer needed.
  • Configure CloudFront URL signing for software installers to prevent predictable URL access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101047. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart