CVE-2026-41262
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Fleet prior to version 4.85.0 contains a vulnerability in the global policy read endpoint (GET /api/latest/fleet/policies/{policy_id}) that fails to verify team ownership of the requested policy, allowing an authenticated user with observer-level access on any single team to read the full details of policies belonging to any other team. Fixed in version 4.85.0.
Risk Assessment
Disclosure of other teams' policies may reveal security monitoring strategies and compliance posture, breaking team isolation.
Recommendation
Update Fleet to version 4.85.0 or later.
Other vulnerabilities in Fleet
See all- CVE-2026-54245High
Fleet is an open-source device management platform. In versions prior to 4.86.2, the Okta conditional access integration in Fleet Premium is vulnerable to SQL injection through a host-supplied value used in a database query without proper parameterization, allowing an attacker controlling one enrolled host to read or modify arbitrary data in the Fleet database. By disclosing arbitrary database contents, an attacker can extract stored session tokens and replay them to act as a global administrator, and on a managed fleet that administrator access enables running scripts on enrolled hosts, leading to remote code execution.
- CVE-2026-46371Medium
Fleet up to version 4.84.1 contains a vulnerability in the Apple MDM commands listing endpoint (GET /api/v1/fleet/mdm/apple/commands) that allows an authenticated user with the Observer role to extract sensitive values such as host enrollment secrets and APNs tokens via a sort-order oracle. An attacker can manipulate the order_key parameter and use binary search to reconstruct values character by character. Fixed in version 4.84.2.
- CVE-2026-46370Medium
Fleet up to version 4.84.1 contains a vulnerability in the labels host-listing endpoint (GET /api/v1/fleet/labels/{id}/hosts) that allows an authenticated user with the Observer role to extract host enrollment secrets via a sort-order oracle. An attacker can manipulate the order_key parameter and reconstruct node_key or orbit_node_key, enabling host impersonation. Fixed in version 4.84.2.
- CVE-2026-48786Medium
Fleet prior to version 4.87.0 contains a vulnerability in the target search endpoint (POST /api/latest/fleet/targets) that returns unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-class users. Fixed in version 4.87.0.
- CVE-2026-44938High
A vulnerability in Fleet allows an attacker with git push access to overwrite Pod Security Standards (PSS) enforcement labels on a target namespace. This occurs because the agent-side deployer does not filter security-sensitive keys from namespaceLabels in fleet.yaml.
Original NVD description (English source)
Fleet is an open-source device management platform built on osquery. In versions prior to 4.85.0, the global policy read endpoint (GET /api/latest/fleet/policies/{policy_id}) fails to verify team ownership of the requested policy, allowing an authenticated user with observer-level access on any single team to read the full details of policies belonging to any other team and bypass Fleet's team isolation model. The handler authorizes the request against an empty policy object whose TeamID is nil, which an authorization rule permits for any user holding a role on any team, and then fetches the policy by ID with no team filter and returns it without any post-fetch scope check. Because policy IDs are sequential integers, an attacker can enumerate them to read other teams' policy SQL queries, host pass and fail counts, and associated software-installer and script metadata, exposing security-monitoring strategies and compliance posture across team boundaries. This issue is fixed in version 4.85.0.