6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23517

CVE-2026-23517: Fleet has an Access Control vulnerability in debug/pprof endpoints

Fleet is open source device management software. A broken access control issue in versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 allowed authenticated users to access debug and profiling endpoints regardless of role. As a result, low-privilege users could view internal server diagnostics and trigger resource-intensive profiling operations. Fleet’s debug/pprof endpoints are accessible to any authenticated user regardless of role, including the lowest-privilege “Observer” role. This allows low-privilege users to access sensitive server internals, including runtime profiling data and in-memory application state, and to trigger CPU-intensive profiling operations that could lead to denial of service. Versions 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 fix the issue. If an immediate upgrade is not possible, users should put the debug/pprof endpoints behind an IP allowlist as a workaround.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23517

CVE-2026-23517:

6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/fleetdm/fleet	go	>= 4.78.0, < 4.78.3	4.78.3
github.com/fleetdm/fleet	go	>= 4.77.0, < 4.77.1	4.77.1
github.com/fleetdm/fleet	go	>= 4.76.0, < 4.76.2	4.76.2
github.com/fleetdm/fleet	go	>= 4.75.0, < 4.75.2	4.75.2
github.com/fleetdm/fleet/v4	go	< 4.78.3-0.20260112221730-5c030e32a3a9	4.78.3-0.20260112221730-5c030e32a3a9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described is an improper access control issue where Fleet's debug/pprof endpoints were accessible to any authenticated user, irrespective of their assigned role. The provided commit patch directly addresses this by modifying the authorization logic.

The analysis of the commit 5c030e32a3a9bc512355b5e1bf19636e4e6d0317 reveals that the change is located in the server/service/debug_handler.go file, specifically within the debugAuthenticationMiddleware.Middleware function. Before the patch, the check was !v.CanPerformActions(). This was not sufficient to prevent low-privilege users from accessing the endpoints. The patch introduces a more stringent check: !v.CanPerformActions() || v.User.GlobalRole == nil || *v.User.GlobalRole != fleet.RoleAdmin. This ensures that only users with the global 'admin' role can access these sensitive endpoints.

Therefore, the service.debugAuthenticationMiddleware.Middleware function is the exact location of the vulnerability. Any attempt to access the debug endpoints, whether successful or not, would involve the execution of this middleware. A runtime profiler would show this function in the call stack during an exploit attempt by a non-admin user.

Vulnerable functions

service.debugAuthenticationMiddleware.Middleware

server/service/debug_handler.go

The vulnerability lies in the `debugAuthenticationMiddleware.Middleware` function, which is responsible for authenticating and authorizing access to the debug/pprof endpoints. The original implementation only checked if the user `CanPerformActions()`, which was insufficient. This allowed any authenticated user, regardless of their role, to access sensitive profiling data. The patch corrects this by adding a check to ensure that the user has the 'admin' global role, thus properly restricting access to the debug endpoints.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.