CVE-2026-24004: Fleet: Unauthenticated Android device disenrollment vulnerability via Pub/Sub endpoint

February 26, 2026

A vulnerability in Fleet’s Android MDM Pub/Sub handling could allow unauthenticated requests to trigger device unenrollment events. This may result in unauthorized removal of individual Android devices from Fleet management.

References

github.com/advisories/GHSA-9pm7-6g36-6j78
github.com/fleetdm/fleet
github.com/fleetdm/fleet/commit/24dd2257ae7127680a2f6cd1a4eee58a9c95dd34
github.com/fleetdm/fleet/security/advisories/GHSA-9pm7-6g36-6j78
nvd.nist.gov/vuln/detail/CVE-2026-24004

Code Behaviors & Features

Detect and mitigate CVE-2026-24004 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →