Security readout for executives and security teams
Plain-English summary
Fleet device management servers had a role-checking flaw: any logged-in user, even an Observer, could access debug/profiling pages. Those pages may expose server internals and can trigger heavy profiling work. The issue is fixed in specified Fleet releases. Business urgency is moderate unless low-privilege Fleet accounts are widely distributed or untrusted.
Executive priority
Prioritize remediation in the normal security patch cycle, faster for internet-facing Fleet instances or environments with many low-privilege users. This is not currently supported as actively exploited by the provided sources, but it can expose sensitive internals and create availability risk.
Technical view
CVE-2026-23517 is a CWE-862 broken access control issue in Fleet debug/pprof endpoints. Affected versions before 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 allowed any authenticated role to view runtime diagnostics and initiate resource-intensive profiling. CVSS v4.0 is 6.3. Vendor workaround: place debug/pprof endpoints behind an IP allowlist.
Likely exposure
Exposure applies to Fleet deployments running affected versions where users can authenticate to the Fleet web application/API. Risk is higher when Observer or other low-privilege accounts are numerous, externally accessible, or assigned to third parties. The provided sources do not state whether default configurations expose these endpoints publicly.
Exploitation context
The advisory states exploitation requires authentication but no special role beyond the lowest-privilege Observer. Impact includes sensitive internal diagnostic disclosure and possible denial of service from CPU-intensive profiling. The source bundle marks KEV as false and provides no cited evidence of active exploitation.
Researcher notes
The key boundary failure is role-independent access to debug/pprof endpoints. The vendor commit and advisory should be used to confirm exact endpoint authorization changes. Evidence is limited to the CVE/advisory bundle; no public exploit status or broader environmental prerequisites are provided.
Mitigation direction
- Upgrade Fleet to 4.78.3, 4.77.1, 4.76.2, 4.75.2, or 4.53.3 as applicable.
- If immediate upgrade is not possible, restrict debug/pprof endpoints with an IP allowlist.
- Review low-privilege Fleet accounts and remove unnecessary access.
- Monitor Fleet server performance and access logs for unusual debug/profiling endpoint activity.
Validation and detection
- Inventory Fleet server versions and compare against the affected version ranges.
- Confirm the installed Fleet version is one of the fixed releases or newer.
- Verify debug/pprof endpoints are not reachable by general authenticated users.
- Check whether IP allowlisting protects debug/pprof endpoints if not yet upgraded.
- Review Fleet logs for authenticated access to debug or pprof paths.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-23517 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
6.3MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/fleetdm/fleet/security/advisories/GHSA-4r5r-ccr6-q6f6CVE reference · x_refsource_CONFIRM
- https://github.com/fleetdm/fleet/commit/5c030e32a3a9bc512355b5e1bf19636e4e6d0317CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.