CVE-2026-26060: 
NixOS vulnerability analysis and mitigation

CVE-2026-26060 is a password reset token reuse vulnerability in FleetDM Fleet, an open-source device management platform. A flaw in Fleet's password management logic allows previously issued password reset tokens to remain valid for up to 24 hours even after a user has changed their password, enabling temporary account takeover if an attacker had prior access to a valid token. All Fleet versions before 4.81.0 are affected. The vulnerability was published on March 27, 2026, and carries a CVSS v3.1 score of 8.8 (High) and a CVSS v4.0 score of 6.0 (Medium) (GitHub Advisory, Fleet Advisory).

The root cause is classified as CWE-613 (Insufficient Session Expiration): Fleet does not invalidate outstanding password reset tokens when a user successfully changes their password, allowing stale tokens to remain usable until their natural 24-hour expiration (GitHub Advisory). An attacker who has previously obtained a valid reset token — for example, through phishing, email interception, or access to a mail server — can submit that token to the password reset endpoint even after the legitimate user has already changed their password, effectively overwriting the new password. Exploitation requires low privileges (possession of a previously compromised token) and no user interaction, but is constrained by the attack requirement that the token must have been obtained prior to exploitation and must not yet have expired (Fleet Advisory).

Successful exploitation results in temporary account takeover: the attacker can reset the victim's password to an attacker-controlled value, gaining full access to the Fleet account and all data and device management capabilities associated with it. Given Fleet's role as a device management platform, a compromised administrator account could expose endpoint telemetry, device configurations, and osquery query results across managed hosts. The vulnerability does not affect accounts without an existing valid reset token, and availability of the Fleet service itself is not directly impacted (Fleet Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported. The EPSS score is approximately 0.022% (7th percentile), indicating a low near-term exploitation probability (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is significantly constrained: it requires prior compromise of a password reset token and is bounded by the 24-hour token expiration window, making opportunistic mass exploitation unlikely.

1. Obtain a valid password reset token: The attacker must first acquire a valid Fleet password reset token for the target account — for example, by intercepting a reset email via phishing, email account compromise, or access to mail server logs.
2. Wait for or trigger a defensive password change: The attacker monitors or waits for the legitimate user to change their password (e.g., after detecting suspicious activity), which would normally invalidate the token but does not in vulnerable Fleet versions.
3. Submit the stale token to the reset endpoint: Within the 24-hour validity window, the attacker submits the previously obtained reset token to Fleet's password reset endpoint (e.g., via an HTTP POST request to the Fleet API's password reset route) with a new attacker-chosen password.
4. Achieve account takeover: Because Fleet does not invalidate the token upon password change, the reset succeeds, setting the account password to the attacker's value and granting full access to the Fleet account (Fleet Advisory).

• Logs: Fleet audit logs showing a password reset event for a user account shortly after a prior password change event for the same account within a 24-hour window; multiple password reset completions for the same user in a short timeframe.
• Network: HTTP POST requests to Fleet's password reset API endpoint originating from an IP address different from the user's known locations, particularly if the request follows a recent legitimate password change.
• Account Behavior: Unexpected login activity or session creation for a user account immediately following a password reset, especially from unfamiliar IP addresses or user agents (Fleet Advisory).

Fleet has released version 4.81.0 (and patch commit bbc1aef2987d for the v4.43.x branch) which resolves this issue by invalidating password reset tokens upon a successful password change. Users should upgrade to Fleet 4.81.0 or later as the primary remediation (Fleet Advisory). As a workaround for unpatched deployments, users who suspect a reset token has been exposed should wait the full 24 hours for the token to expire before using the account, or contact a Fleet administrator to manually invalidate active sessions. Fleet can be reached at security@fleetdm.com for additional guidance.

The vulnerability was responsibly disclosed by researcher @fuzzztf and acknowledged by the Fleet security team, who published the advisory on March 27, 2026 (Fleet Advisory). The issue received routine coverage in vulnerability aggregation feeds and security mailing lists, including openSUSE security announcements related to govulncheck/vulndb updates (GitHub Advisory). No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified.