Description
Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoint (GET /api/v1/fleet/labels/{id}/hosts) allowed an authenticated user with the lowest-privilege Observer role to extract host enrollment secrets through a sort-order oracle. The endpoint accepted a user-supplied order_key parameter that was not validated against a column allowlist, so an attacker with Global or Team Observer access could set the sort column to a sensitive field such as h.node_key and combine it with the cursor-based after parameter to binary-search the value one character at a time; the targeted value never appeared in the response, but the presence or absence of results revealed each character. Because node_key and orbit_node_key are the long-lived shared secrets that osquery and Orbit agents use to authenticate to the Fleet server, an attacker who reconstructed them could impersonate enrolled hosts, submit fabricated query results and inventory, retrieve pending scripts and MDM commands, and poison compliance and policy results across the deployment. This issue is fixed in version 4.84.2.
Published: 2026-08-26
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An unsanitized order_key parameter in the /api/v1/fleet/labels/{id}/hosts endpoint permitted an authenticated Observer to perform an ORDER BY oracle. By supplying a column such as h.node_key and using the after parameter, a binary search could be carried out character by character, revealing the long‑lived shared secrets used for host authentication. The leaked node_key and orbit_node_key allow the attacker to impersonate enrolled agents, inject false query results, retrieve scheduled scripts, and manipulate compliance data, effectively undermining the integrity and confidentiality of the entire Fleet deployment.

Affected Systems

The vulnerability affects Fleet, the open‑source device‑management platform built on osquery, in all releases up to and including 4.84.1. The issue is fixed starting with version 4.84.2.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate severity. The flaw requires an authenticated observer with either Global or Team observer privileges; the attacker does not need elevated access, but must have a valid account. The vulnerability is not yet listed in CISA’s KEV catalog and no EPSS score is available, yet compromising node_keys can lead to full host impersonation and data tampering, representing high operational risk within the affected environment.

Generated by OpenCVE AI on August 26, 2026 at 20:43 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Fleet to version 4.84.2 or later to eliminate the exploitation path
  • Revoke or restrict the use of Global and Team Observer roles, ensuring only the minimum set of users hold observer privileges
  • If a patch cannot be applied immediately, implement a temporary internal filter to validate the order_key parameter against an accepted list of columns to prevent oracle exploitation

Generated by OpenCVE AI on August 26, 2026 at 20:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-vxm7-9x8v-8gm4 Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint
History

Wed, 26 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Fleetdm
Fleetdm fleet
Vendors & Products Fleetdm
Fleetdm fleet

Wed, 26 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Description Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoint (GET /api/v1/fleet/labels/{id}/hosts) allowed an authenticated user with the lowest-privilege Observer role to extract host enrollment secrets through a sort-order oracle. The endpoint accepted a user-supplied order_key parameter that was not validated against a column allowlist, so an attacker with Global or Team Observer access could set the sort column to a sensitive field such as h.node_key and combine it with the cursor-based after parameter to binary-search the value one character at a time; the targeted value never appeared in the response, but the presence or absence of results revealed each character. Because node_key and orbit_node_key are the long-lived shared secrets that osquery and Orbit agents use to authenticate to the Fleet server, an attacker who reconstructed them could impersonate enrolled hosts, submit fabricated query results and inventory, retrieve pending scripts and MDM commands, and poison compliance and policy results across the deployment. This issue is fixed in version 4.84.2.
Title Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint
Weaknesses CWE-200
CWE-89
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Fleetdm Fleet
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-26T18:54:31.761Z

Reserved: 2026-05-13T19:53:47.921Z

Link: CVE-2026-46370

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-26T20:17:23.327

Modified: 2026-08-26T20:17:23.327

Link: CVE-2026-46370

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T20:45:03Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')