CVE-2026-48786
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Fleet prior to version 4.87.0 contains a vulnerability in the target search endpoint (POST /api/latest/fleet/targets) that returns unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-class users. Fixed in version 4.87.0.
Risk Assessment
Disclosure of enrollment secrets and credentials may allow an attacker to enroll unauthorized hosts and access sensitive authentication data.
Recommendation
Update Fleet to version 4.87.0 or later.
Other vulnerabilities in Fleet
See all- CVE-2026-54245High
Fleet is an open-source device management platform. In versions prior to 4.86.2, the Okta conditional access integration in Fleet Premium is vulnerable to SQL injection through a host-supplied value used in a database query without proper parameterization, allowing an attacker controlling one enrolled host to read or modify arbitrary data in the Fleet database. By disclosing arbitrary database contents, an attacker can extract stored session tokens and replay them to act as a global administrator, and on a managed fleet that administrator access enables running scripts on enrolled hosts, leading to remote code execution.
- CVE-2026-46371Medium
Fleet up to version 4.84.1 contains a vulnerability in the Apple MDM commands listing endpoint (GET /api/v1/fleet/mdm/apple/commands) that allows an authenticated user with the Observer role to extract sensitive values such as host enrollment secrets and APNs tokens via a sort-order oracle. An attacker can manipulate the order_key parameter and use binary search to reconstruct values character by character. Fixed in version 4.84.2.
- CVE-2026-46370Medium
Fleet up to version 4.84.1 contains a vulnerability in the labels host-listing endpoint (GET /api/v1/fleet/labels/{id}/hosts) that allows an authenticated user with the Observer role to extract host enrollment secrets via a sort-order oracle. An attacker can manipulate the order_key parameter and reconstruct node_key or orbit_node_key, enabling host impersonation. Fixed in version 4.84.2.
- CVE-2026-41262Medium
Fleet prior to version 4.85.0 contains a vulnerability in the global policy read endpoint (GET /api/latest/fleet/policies/{policy_id}) that fails to verify team ownership of the requested policy, allowing an authenticated user with observer-level access on any single team to read the full details of policies belonging to any other team. Fixed in version 4.85.0.
- CVE-2026-44938High
A vulnerability in Fleet allows an attacker with git push access to overwrite Pod Security Standards (PSS) enforcement labels on a target namespace. This occurs because the agent-side deployer does not filter security-sensitive keys from namespaceLabels in fleet.yaml.
Original NVD description (English source)
Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint (POST /api/latest/fleet/targets) returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-class users. Other team-facing endpoints mask these fields for observers, but the target search endpoint did not apply the same sanitization, so an authenticated user with the Observer, Observer+, or Technician role, whether global or team-scoped, could retrieve the secrets and agent options by performing a target search against an observer-runnable query. With a leaked team enroll secret an attacker could enroll unauthorized hosts into the affected team, and if the team's agent options contained credentials such as AWS secret access keys or proxy passwords, those values were disclosed as well. This issue is fixed in version 4.87.0.