Fleet’s Windows MDM management endpoint relied on mutual TLS client certificates for authentication. Prior to version 4.81.0, requests that omitted a client certificate were incorrectly granted trust, allowing an attacker who knew a valid enrolled device identifier to impersonate that device and receive configuration payloads such as Wi‑Fi, VPN, certificate or other secret data. The vulnerability does not enable new device enrollment, administrative control of Fleet, or compromise of the control plane; the compromise is limited to disclosure of configuration information for the targeted device.

The flaw affects the open‑source Fleet device‑management suite from FleetDM, specifically all versions prior to 4.81.0. Users of those releases are potentially exposed if they have a Windows MDM endpoint enabled and can supply a known enrolled device identifier.

The CVSS score of 8.2 indicates a high‑severity flaw. While no EPSS score is available, the lack of an active KEV listing suggests no widespread exploitation to date; however, the attack requires knowledge of a device identifier and the ability to send an HTTP request to the Fleet MDM endpoint. Attackers with network or privileged access to the Fleet server can exploit the bypass, though they cannot add new devices or gain Fleet administrative access.