CVE-2026-34391: 
NixOS vulnerability analysis and mitigation

CVE-2026-34391 is a cross-device MDM command disclosure vulnerability in Fleet, an open-source device management platform. Prior to version 4.81.1, a malicious enrolled Windows device can access MDM commands intended for other enrolled devices, potentially exposing sensitive configuration data including WiFi credentials, VPN secrets, and certificate payloads. The vulnerability was published on March 27, 2026, and patched in Fleet version 4.81.1. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.6 (Medium) (GitHub Advisory).

The root cause is classified as CWE-488 (Exposure of Data Element to Wrong Session). When a Windows device reports a specific SyncML status code during MDM communication, Fleet attempts to resend the original command by looking it up in a shared command table. A device-controlled value used in this lookup is not properly validated or scoped to the requesting device, allowing a malicious enrolled device to match and retrieve commands belonging to other enrolled devices. The matched commands are then re-queued to the attacker's device and delivered on the next check-in. Exploitation requires the attacker to control a device already enrolled in Fleet's Windows MDM; the vulnerability does not affect instances where Windows MDM is disabled or where no Windows devices are enrolled (GitHub Advisory).

A malicious enrolled Windows device can intercept MDM commands intended for any other device in the fleet, exposing highly sensitive configuration payloads such as WiFi credentials, VPN secrets, and certificate data across the entire Windows device population managed by the Fleet instance. The impact is limited to confidentiality — there is no integrity or availability impact — but the breadth of exposure is significant, as a single compromised or attacker-controlled device could harvest credentials and secrets from the entire managed fleet. This could facilitate lateral movement or further network compromise if harvested credentials are reused (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-34391. The EPSS score is approximately 0.024%, indicating a low probability of exploitation in the near term. The CVSSv4 exploit maturity is rated "Unreported." Exploitation requires an attacker to already have a device enrolled in the target Fleet Windows MDM environment, which limits the attack surface. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The issue was responsibly disclosed by researcher @fuzzztf (GitHub Advisory).

1. Enroll a malicious device: Enroll an attacker-controlled Windows device into the target Fleet Windows MDM environment.
2. Trigger SyncML status code: During MDM communication, send a specific SyncML status code that causes Fleet to attempt to resend an original command by querying the shared command table.
3. Manipulate the lookup value: Craft the device-controlled value used in the command lookup to reference command identifiers belonging to other enrolled devices rather than the attacker's own device.
4. Receive cross-device commands: On the next MDM check-in, Fleet re-queues and delivers the matched commands (intended for other devices) to the attacker's device, exposing their payloads — including WiFi credentials, VPN secrets, and certificate data.
5. Harvest sensitive data: Extract the sensitive configuration data from the received MDM commands for use in further attacks such as unauthorized network access or lateral movement (GitHub Advisory).

• Logs: Fleet server logs showing a single device receiving an unusually high volume of MDM commands, or commands associated with device identifiers other than the requesting device's own identifier.
• Logs: Repeated SyncML status codes from a single device that trigger command re-queue operations in Fleet's MDM processing pipeline.
• Network: MDM check-in requests from a device that result in delivery of configuration payloads (WiFi profiles, VPN configs, certificates) not originally targeted at that device.
• Application: Fleet audit logs showing MDM commands for multiple device targets being delivered to a single enrolled device across successive check-ins (GitHub Advisory).

Fleet has released version 4.81.1, which patches this vulnerability by properly validating and scoping the device-controlled lookup value used in MDM command retrieval. Organizations unable to upgrade immediately should temporarily disable Windows MDM within their Fleet instance to eliminate the attack surface. For questions or concerns, Fleet's security team can be contacted at security@fleetdm.com or via the #fleet channel in the osquery Slack (GitHub Advisory).

The vulnerability was responsibly disclosed by researcher @fuzzztf and published by Fleet maintainer lukeheath via GitHub Security Advisories on March 27, 2026. No significant broader media coverage or notable public researcher commentary beyond the official advisory has been identified at this time (GitHub Advisory).