CVE-2026-101047 in Fleet
Summary
by MITRE • 09/27/2026
Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enterprise tier only) with the intended random, time-limited URL token. Because Apple's InstallEnterpriseApplication MDM command requires these URLs to be reachable without a Fleet session, they cannot rely on session-based authentication, and the missing token allows an unauthenticated attacker with network access to the Fleet server to download in-house IPA binaries and their metadata (bundle identifier, version, and name) by guessing sequential title identifiers. The impact is limited to read-only disclosure; there is no privilege escalation or write access, and the free tier is unaffected (it returns fleet.ErrMissingLicense).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/27/2026
The vulnerability identified in Fleet versions prior to 4.87.0 represents a critical authentication bypass affecting the enterprise tier specifically. This flaw centers on two specific endpoints responsible for serving in-house iOS application packages, commonly known as IPA files, and their associated manifest metadata. In standard web security practices, sensitive resources are typically protected by session-based tokens or cookies that verify user identity and authorization before granting access. However, this particular implementation failed to enforce such protections because of a technical constraint imposed by Apple's Mobile Device Management (MDM) protocol. The InstallEnterpriseApplication command within the MDM specification requires that URLs pointing to enterprise application packages be accessible without requiring an active Fleet session or authentication handshake during the installation process on managed devices. This architectural requirement created a gap where developers assumed that because no user session was needed for functionality, additional security layers like random time-limited URL tokens were unnecessary, leading to a significant oversight in access control design.
The technical flaw lies in the absence of randomized, time-bound authentication tokens for these specific endpoints. Instead of generating unique, unpredictable URLs with expiration times similar to those used for other sensitive operations, Fleet served these files using predictable sequential identifiers based on title IDs. This approach relies entirely on obscurity rather than cryptographic security or strict access control mechanisms. An attacker who gains network-level access to the Fleet server can exploit this predictability by systematically guessing or iterating through sequential integer values in the URL path. Since there is no session validation and the identifiers are sequential, an unauthenticated actor can successfully retrieve the binary IPA files along with their metadata, which includes bundle identifiers, version numbers, and application names. This mechanism effectively turns a security feature intended for seamless device management into an open directory listing accessible to anyone on the network who knows how to enumerate these IDs.
The operational impact of this vulnerability is primarily focused on information disclosure rather than direct system compromise or privilege escalation. The attacker gains read-only access to proprietary software binaries and associated metadata. While there is no immediate risk of executing arbitrary code on the Fleet server itself, nor any ability to modify existing configurations or escalate privileges within the application, the exposure of in-house iOS applications poses significant risks. These applications often contain internal business logic, intellectual property, and potentially hardcoded secrets or configuration data that could be reverse-engineered by a malicious actor. Furthermore, exposing version numbers and bundle identifiers aids attackers in mapping out the organization's technology stack, facilitating further targeted attacks against specific versions of these apps if they are known to have other vulnerabilities. It is important to note that this vulnerability does not affect the free tier of Fleet; attempts to access these endpoints under a non-enterprise license result in an error indicating missing licensing rights, thereby limiting the scope strictly to organizations with enterprise subscriptions.
To mitigate this risk and align with industry best practices for secure API design, it is imperative to implement robust authentication mechanisms even when session-based flows are not natively supported by external protocols like MDM. One effective strategy involves using signed URLs or temporary access tokens that expire after a short duration, ensuring that the resource cannot be accessed indefinitely without valid authorization. This approach satisfies Apple's requirement for unauthenticated network reachability during installation while maintaining security through time-bound validity rather than static accessibility. Additionally, organizations should ensure they upgrade to Fleet version 4.87.0 or later, where this vulnerability has been addressed by introducing proper token-based protection for these endpoints. Security teams should also audit their MDM configurations and review any custom integrations that expose internal resources over the network, ensuring that all external-facing services adhere to principles of least privilege and defense in depth. This incident highlights the importance of balancing functional requirements with security controls, particularly when integrating third-party standards like Apple's MDM framework into enterprise management platforms.