Fleet, an open source device management software, prior to version 4.80.1, determines client public IP addresses based on HTTP headers such as X-Forwarded-For, X-Real-IP, and True-Client-IP without validating their authenticity. This allows both authenticated and unauthenticated clients to supply arbitrary IP values, causing Fleet to treat each request as originating from different IP addresses. Consequently, attackers can bypass per-IP rate limiting controls designed to limit authentication attempts, thereby facilitating brute-force or password-spraying attacks. The vulnerability is classified under CWE-290 (Authentication Bypass by Spoofing). Version 4.80.1 includes a patch that addresses this issue. Alternatively, deploying Fleet behind a trusted reverse proxy or load balancer that overwrites these headers serves as a mitigation.

Attackers can spoof client IP addresses to bypass per-IP rate limiting controls on authentication endpoints, increasing the risk of successful brute-force or password-spraying attacks. However, this vulnerability alone does not enable authentication bypass, privilege escalation, data exposure, or remote code execution.

Upgrade Fleet to version 4.80.1 or later, which contains a patch for this vulnerability. If immediate upgrading is not possible, deploy Fleet behind a trusted reverse proxy or load balancer that overwrites client IP headers such as X-Forwarded-For, X-Real-IP, and True-Client-IP to prevent IP spoofing. Patch status is not explicitly confirmed in the advisory, but the vendor states version 4.80.1 contains a patch. Check the vendor advisory for the latest remediation guidance.