CVE-2026-24000

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.80.1

Description Fleet trusted client-supplied IP address headers when determining the source IP for incoming requests. This allowed authenticated and unauthenticated clients to spoof their apparent IP address and bypass per-IP rate limiting controls. The software determines a client’s public IP address using HTTP headers such as "X-Forwarded-For", "X-Real-IP", and "True-Client-IP", which were trusted without validation. An attacker could supply arbitrary values in these headers, causing the system to treat each request as originating from a different IP address, thereby increasing the effectiveness of brute-force or password-spraying attempts against authentication endpoints.

Recommendations Update to version 4.80.1. Run Fleet behind a trusted reverse proxy or load balancer that overwrites client IP headers.