CVE-2026-24004

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24004", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-19T18:49:20.659Z", "datePublished": "2026-02-26T02:43:14.600Z", "dateUpdated": "2026-02-26T14:33:57.282Z"}, "containers": {"cna": {"title": "Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 1.7, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:U", "version": "4.0"}}], "references": [{"name": "https://github.com/fleetdm/fleet/security/advisories/GHSA-9pm7-6g36-6j78", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-9pm7-6g36-6j78"}], "affected": [{"vendor": "fleetdm", "product": "fleet", "versions": [{"version": "< 4.80.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T02:43:14.600Z"}, "descriptions": [{"lang": "en", "value": "Fleet is open source device management software. In versions prior to 4.80.1, a vulnerability in Fleet\u2019s Android MDM Pub/Sub handling could allow unauthenticated requests to trigger device unenrollment events. This may result in unauthorized removal of individual Android devices from Fleet management. If Android MDM is enabled, an attacker could send a crafted request to the Android Pub/Sub endpoint to unenroll a targeted Android device from Fleet without authentication. This issue does not grant access to Fleet, allow execution of commands, or provide visibility into device data. Impact is limited to disruption of Android device management for the affected device. Version 4.80.1 fixes the issue. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Android MDM."}], "source": {"advisory": "GHSA-9pm7-6g36-6j78", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T14:33:39.131793Z", "id": "CVE-2026-24004", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T14:33:57.282Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24004", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T14:33:39.131793Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T14:33:47.683Z"}}], "cna": {"title": "Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint", "source": {"advisory": "GHSA-9pm7-6g36-6j78", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 1.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:U", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "fleetdm", "product": "fleet", "versions": [{"status": "affected", "version": "< 4.80.1"}]}], "references": [{"url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-9pm7-6g36-6j78", "name": "https://github.com/fleetdm/fleet/security/advisories/GHSA-9pm7-6g36-6j78", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Fleet is open source device management software. In versions prior to 4.80.1, a vulnerability in Fleet\u2019s Android MDM Pub/Sub handling could allow unauthenticated requests to trigger device unenrollment events. This may result in unauthorized removal of individual Android devices from Fleet management. If Android MDM is enabled, an attacker could send a crafted request to the Android Pub/Sub endpoint to unenroll a targeted Android device from Fleet without authentication. This issue does not grant access to Fleet, allow execution of commands, or provide visibility into device data. Impact is limited to disruption of Android device management for the affected device. Version 4.80.1 fixes the issue. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Android MDM."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T02:43:14.600Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24004", "state": "PUBLISHED", "dateUpdated": "2026-02-26T14:33:57.282Z", "dateReserved": "2026-01-19T18:49:20.659Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-26T02:43:14.600Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "fleet", "vendor": "fleetdm", "versions": [{"status": "affected", "version": "< 4.80.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fleetdm:fleet:*:*:*:*:*:*:*:*", "matchCriteriaId": "A1490125-39FE-4B90-AC5F-62B26ED3C509", "versionEndExcluding": "4.80.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Fleet is open source device management software. In versions prior to 4.80.1, a vulnerability in Fleet\u2019s Android MDM Pub/Sub handling could allow unauthenticated requests to trigger device unenrollment events. This may result in unauthorized removal of individual Android devices from Fleet management. If Android MDM is enabled, an attacker could send a crafted request to the Android Pub/Sub endpoint to unenroll a targeted Android device from Fleet without authentication. This issue does not grant access to Fleet, allow execution of commands, or provide visibility into device data. Impact is limited to disruption of Android device management for the affected device. Version 4.80.1 fixes the issue. If an immediate upgrade is not possible, affected Fleet users should temporarily disable Android MDM."}, {"lang": "es", "value": "Fleet es un software de gesti\u00f3n de dispositivos de c\u00f3digo abierto. En versiones anteriores a la 4.80.1, una vulnerabilidad en el manejo de Pub/Sub de MDM de Android de Fleet podr\u00eda permitir que solicitudes no autenticadas desencadenen eventos de desinscripci\u00f3n de dispositivos. Esto puede resultar en la eliminaci\u00f3n no autorizada de dispositivos Android individuales de la gesti\u00f3n de Fleet. Si el MDM de Android est\u00e1 habilitado, un atacante podr\u00eda enviar una solicitud manipulada al endpoint de Pub/Sub de Android para desinscribir un dispositivo Android objetivo de Fleet sin autenticaci\u00f3n. Este problema no otorga acceso a Fleet, no permite la ejecuci\u00f3n de comandos ni proporciona visibilidad de los datos del dispositivo. El impacto se limita a la interrupci\u00f3n de la gesti\u00f3n de dispositivos Android para el dispositivo afectado. La versi\u00f3n 4.80.1 corrige el problema. Si una actualizaci\u00f3n inmediata no es posible, los usuarios afectados de Fleet deber\u00edan deshabilitar temporalmente el MDM de Android."}], "id": "CVE-2026-24004", "lastModified": "2026-06-17T10:22:27.860", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.7, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24004", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T14:33:39.131793Z", "version": "2.0.3"}}]}, "published": "2026-02-26T03:16:04.183", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-9pm7-6g36-6j78"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.80.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "fleet", "source": "cna", "vendor": "fleetdm"}, "product": "fleet", "vendor": "fleetdm"}], "analysis": {"en": {"generated_at": "2026-04-17T14:26:57.295886+00:00", "value": {"mitigation_remediation": ["Upgrade Fleet to version 4.80.1 or later to eliminate the flaw", "If an upgrade is not immediately possible, disable the Android MDM feature in Fleet to block further unenrollment attempts", "Monitor Fleet logs for unexpected unenrollment events and verify no additional Pub/Sub endpoints are reachable by unauthenticated actors"], "summary": {"action": "Patch", "impact": "Unauthorized Android device disenrollment"}, "threat_synthesis": {"affected_systems": "The issue applies to the fleetdm fleet product in all versions older than 4.80.1. Android devices managed through Fleet\u2019s MDM feature are the relevant scope. Versions 4.80.1 and newer contain the fix.", "description_and_impact": "Fleet, an open\u2011source device management platform, contained a flaw in its Android Mobile Device Management Pub/Sub handling that allows an unauthenticated attacker to trigger a device unenrollment event. The vulnerability does not grant access to Fleet, execution of commands, or visibility into device data, but it can remove a target Android device from management, disrupting its administration and any remote policies applied to it.", "risk_and_exploitability": "The CVSS score of 1.7 and an EPSS score less than 1\u202f% indicate a low threat level and a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires no authentication or privilege and simply causes a single managed device to be removed from administration, offering no broader system compromise."}}}}, "created": "2026-02-26T13:09:44.601017+00:00", "updated": "2026-04-17T14:30:20.829810+00:00", "vendors": ["fleetdm", "fleetdm$PRODUCT$fleet"]}