CVE-2026-24004: 
NixOS vulnerability analysis and mitigation

CVE-2026-24004 is an unauthenticated Android device unenrollment vulnerability in Fleet, an open-source device management platform. The flaw exists in Fleet's Android MDM Pub/Sub handling, allowing unauthenticated requests to trigger device unenrollment events and remove Android devices from Fleet management without authorization. All Fleet versions prior to 4.80.1 are affected. The vulnerability was disclosed on February 26, 2026, with a fix released in version 4.80.1. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Feedly).

The root cause is a missing authorization check (CWE-862 / CWE-306) on Fleet's Android MDM Pub/Sub endpoint. In vulnerable versions, the handlePubSubStatusReport function called svc.authz.SkipAuthorization(ctx) before performing authentication, meaning a DELETED notification type could be processed without verifying the caller's identity. An unauthenticated attacker can send a crafted HTTP request to the Android Pub/Sub endpoint with a device deletion payload to trigger unenrollment of a targeted Android device. The fix (commit 24dd225) reworks the endpoint to call authenticatePubSub at the start of handlePubSubStatusReport before processing any message content, and adjusts error status codes to prevent Pub/Sub retry loops (GitHub Commit, GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to remove individual Android devices from Fleet management, disrupting mobile device management (MDM) operations for those devices. The vulnerability does not grant access to Fleet itself, does not allow command execution, and does not expose device data or credentials. The impact is strictly limited to integrity disruption — specifically, unauthorized modification of device enrollment state — with no confidentiality or availability impact on the Fleet platform itself (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The vulnerability requires Android MDM to be enabled in Fleet and requires the attacker to know or guess a valid device identifier to target a specific device. The EPSS score is approximately 0.10%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It was responsibly disclosed by researcher @secfox-ai (prateek-0490) (GitHub Advisory).

1. Reconnaissance: Identify Fleet instances with Android MDM enabled by probing publicly accessible Fleet deployments or through organizational knowledge of the target environment.
2. Identify the Pub/Sub endpoint: Locate the Android MDM Pub/Sub endpoint exposed by the Fleet server (e.g., the endpoint handled by ProcessPubSubPush in server/mdm/android/service/pubsub.go).
3. Craft a malicious request: Construct an HTTP POST request to the Android Pub/Sub endpoint containing a base64-encoded JSON payload that mimics a DELETED device status notification, including a target device identifier.
4. Send unauthenticated request: Submit the crafted request without any authentication token or with an invalid token. In vulnerable versions, the authorization check is skipped for DELETED notification types, allowing the request to be processed.
5. Trigger unenrollment: The Fleet server processes the fake deletion event and unenrolls the targeted Android device from Fleet management, removing it from the managed device inventory (GitHub Commit, GitHub Advisory).

• Network: Unexpected HTTP POST requests to the Fleet Android Pub/Sub endpoint originating from unknown or external IP addresses, particularly with DELETED device notification payloads.
• Logs: Fleet server logs showing unenrollment events for Android devices that were not initiated by an administrator; authentication failures or skipped authorization entries in Fleet audit logs around the time of device removal.
• Application: Sudden or unexplained disappearance of Android devices from the Fleet device inventory, especially multiple devices in a short time window without corresponding admin actions.

Upgrade Fleet to version 4.80.1 or later, which contains the fix that enforces authentication at the start of the handlePubSubStatusReport function before processing any Pub/Sub message (GitHub Advisory). If an immediate upgrade is not possible, temporarily disable Android MDM in Fleet to prevent the vulnerable endpoint from being reachable. Organizations should also review Fleet audit logs for any unexpected Android device unenrollment events that may have occurred prior to patching.

The vulnerability was responsibly disclosed by researcher @secfox-ai (GitHub: prateek-0490) and acknowledged by the Fleet security team in the official advisory (GitHub Advisory). The advisory was published by Fleet maintainer lukeheath and received standard coverage from vulnerability tracking services including Vulners, CVEFeed, and ENISA's EUVD. No significant broader media coverage or notable community controversy has been observed.