Fleet trusted client‑supplied IP headers such as X‑Forwarded‑For, X‑Real‑IP and True‑Client‑IP without validation, allowing an attacker to spoof any address and cause Fleet to treat each request as originating from a distinct IP. This flaw enables bypass of per‑IP rate limiting controls and can increase the effectiveness of brute‐force or password‑spraying attacks against authentication endpoints. The vulnerability does not provide authentication bypass, privilege escalation, data exposure, or remote code execution on its own and is marked as CWE‑290.

The issue affects Fleet open‑source device management software provided by FleetDM. Any Fleet installation using a version earlier than 4.80.1 is vulnerable and relies on untrusted client‑supplied IP headers for source address determination.

The CVSS score of 6.9 indicates moderate severity. Because the EPSS score is not available and the flaw is not listed in the CISA KEV catalog, there is no current evidence of widespread exploitation. However, the flaw can be triggered via normal HTTP requests with fabricated headers, meaning an attacker with network access or ability to send arbitrary requests can bypass rate limits and mount more efficient credential‑guessing attacks. The risk is moderate to high, especially in environments with high authentication traffic or where robust rate limiting is essential. The absence of a known exploit does not diminish the importance of applying the available fix.