---
id: "CVE-2026-111923"
kind: "vulnerability"
aliases: ["CVE-2026-111923"]
title: "Fleet MDM server: crafted enrollment plist crashes server via recursion"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "fleet", "fixed": ["4.89.0"], "affected": "< 4.89.0", "ecosystem": "go"}]
ecosystems: []
tags: ["apple-mdm", "dos", "fleet", "other", "self-hosted"]
not_affected_if: ["apple-mdm-disabled", "fleet-version-4.89.0-or-later", "managed-hosting", "no-apple-mdm-enrollment"]
published_at: "2026-10-17T19:16:35+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-24T00:23:31+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111923", "first_seen_at": "2026-10-23T21:57:14+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:23:31+00:00"}]
---

# Fleet MDM server: crafted enrollment plist crashes server via recursion

Fleet before 4.89.0 parses Apple MDM enrollment/check-in property lists with unbounded recursion. An unauthenticated attacker with network access can send a ~150-byte binary plist to the enrollment endpoints and crash the server through CPU and memory exhaustion. Availability only. Only instances with Apple MDM enabled are affected.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:fleet affected < 4.89.0 fixed 4.89.0

## How to check

Check your Fleet version (fleet version, or the version shown in the UI); anything below 4.89.0 is affected. Then check whether Apple MDM is enabled (Settings > Integrations > MDM) and whether /api/mdm/apple/enroll and /api/mdm/apple/account_driven_enroll are reachable from untrusted networks.

## Fix

Upgrade Fleet to 4.89.0 or later (4.92.0 also moves the fix into upstream micromdm/plist v0.3.0). Workaround: restrict network access to /api/mdm/apple/enroll and /api/mdm/apple/account_driven_enroll to trusted networks; request size limits do not help.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111923
- 2026-10-24T00:23:31+00:00 analyst — Read Fleet GHSA-x467-vgxf-2g6h (primary) plus VulnCheck/CVE record. Only Apple MDM-enabled instances affected; no exploitation or PoC found; X count 3, no useful posts saved.

## Documents

- [advisory] Fleet GHSA-x467-vgxf-2g6h: unbounded recursion in Apple MDM enrollment plist parsing https://github.com/fleetdm/fleet/security/advisories/GHSA-x467-vgxf-2g6h
- [describes] VulnCheck: Fleet before 4.89.0 Unauthenticated DoS via Apple MDM Enrollment Plist Parsing https://www.vulncheck.com/advisories/fleet-before-4.89.0-unauthenticated-dos-via-apple-mdm-enrollment-plist-parsing

## From the sources

Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment endpoints, triggering exponential allocation or infinite recursion that exhausts CPU and memory.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_