CVE-2026-24899: Fleet Windows MDM Azure AD JWT Authentication Bypass

May 14, 2026 (updated June 8, 2026)

A vulnerability in Fleet’s Windows MDM enrollment flow allows authentication tokens from any Azure AD tenant to be accepted. Because Fleet validates JWT signatures using Microsoft’s multi-tenant JWKS endpoint but does not enforce the aud (audience) or iss (issuer) claims, any Microsoft-signed Azure AD access token containing the expected scopes can be used to authenticate to Fleet’s MDM endpoints.

References

github.com/advisories/GHSA-ffg9-j72f-j6xm
github.com/fleetdm/fleet/releases/tag/fleet-v4.82.0
github.com/fleetdm/fleet/security/advisories/GHSA-ffg9-j72f-j6xm
nvd.nist.gov/vuln/detail/CVE-2026-24899

Code Behaviors & Features

Detect and mitigate CVE-2026-24899 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →