CVE-2026-23517: 
NixOS vulnerability analysis and mitigation

CVE-2026-23517 is a broken access control vulnerability in Fleet, an open-source device management platform, affecting the Go package github.com/fleetdm/fleet. The flaw allows any authenticated user — including those with the lowest-privilege "Observer" role — to access the server's debug/pprof profiling endpoints without proper role-based authorization checks. It was disclosed on January 20, 2026, and affects Fleet versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 6.3 (Medium) (Github Advisory, Fleet Advisory).

The root cause is classified as CWE-862 (Missing Authorization) and CWE-863 (Incorrect Authorization). Fleet's debugAuthenticationMiddleware in server/service/debug_handler.go only checked whether a user could perform general actions (CanPerformActions()), but did not verify that the user held the Admin global role before granting access to the /debug/pprof endpoints. The fix, introduced in commit 5c030e3, adds an additional check requiring v.User.GlobalRole == nil || *v.User.GlobalRole != fleet.RoleAdmin, restricting access to global administrators only. Exploitation requires only a valid authenticated session — no elevated privileges are needed — making it trivially exploitable by any registered user (Fleet Advisory, Fix Commit).

Successful exploitation allows low-privilege users to access sensitive server internals exposed via Go's pprof profiling endpoints, including runtime profiling data, goroutine stacks, heap allocations, and in-memory application state. Additionally, attackers can trigger CPU-intensive profiling operations (e.g., CPU profiles, trace captures) that are resource-heavy and could degrade or deny service to the Fleet server. The confidentiality impact is high due to exposure of internal diagnostics, and the availability impact is high due to the potential for denial of service through repeated profiling requests (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.038% (0.000380), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is straightforward for any authenticated Fleet user, requiring only a valid session token and knowledge of the /debug/pprof endpoint paths.

1. Obtain credentials: Acquire any valid Fleet user account, including the lowest-privilege "Observer" role — this could be a free trial account, a compromised low-privilege credential, or a self-registered account if open registration is enabled.
2. Authenticate: Log in to the Fleet instance and obtain a valid session token (Bearer token) via the Fleet API or web UI.
3. Access pprof endpoints: Send an authenticated HTTP GET request to the /debug/pprof/ endpoint, e.g.:

   GET /debug/pprof/heap HTTP/1.1
   Host: <fleet-server>
   Authorization: BEARER <session_token>

4. Exfiltrate diagnostics: Parse the returned profiling data to extract runtime memory state, goroutine stacks, or other internal application details that may reveal sensitive configuration or operational information.
5. Trigger denial of service: Repeatedly request CPU-intensive profiles (e.g., /debug/pprof/profile?seconds=30) to consume server CPU resources and degrade availability for legitimate users (Fleet Advisory, Fix Commit).

• Network: Unusual HTTP GET requests to /debug/pprof/, /debug/pprof/heap, /debug/pprof/goroutine, /debug/pprof/profile, or /debug/pprof/cmdline from non-administrative user sessions; repeated requests to /debug/pprof/profile with long seconds parameters indicating DoS attempts.
• Logs: Fleet access logs showing requests to /debug/* endpoints authenticated with Observer or Maintainer role session tokens; HTTP 200 responses to /debug/pprof/ paths from low-privilege accounts (pre-patch behavior).
• Process: Elevated CPU utilization on the Fleet server process coinciding with requests to /debug/pprof/profile or /debug/pprof/trace endpoints.

Fleet has released patched versions addressing this issue: 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3. Upgrading to the appropriate patched version for your release branch is the recommended remediation. If an immediate upgrade is not possible, restrict access to the /debug/pprof endpoints by placing them behind an IP allowlist, limiting access to trusted administrative networks only. Contact Fleet at security@fleetdm.com or the #fleet channel in the osquery Slack for additional guidance (Fleet Advisory).

The vulnerability was responsibly disclosed by researcher @secfox-ai (GitHub: prateek-0490) and remediated by Fleet developer iansltx. Fleet published the advisory on January 20, 2026, and credited the reporter publicly. No significant broader media coverage or notable community controversy has been identified beyond standard vulnerability tracking (Fleet Advisory).