The Fleet device‑management API allowed an authenticated user with the Observer privilege to request the Apple MDM commands list using the order_key query parameter. The parameter is not checked against a whitelist of columns, and because the underlying query joins hosts and nano_enrollments tables, the attacker can choose a sensitive column such as host enrollment secrets or APNs tokens. By repeatedly querying with different order_key values and a cursor‑based after parameter, the attacker can binary‑search each character of the secret, learning it without it appearing in the response. The recovered node_key or orbit_node_key can then be used to impersonate an enrolled device, allowing the attacker to submit fabricated host data and retrieve any pending scripts or commands.

This flaw exists in all Fleet releases up to and including version 4.84.1 of the Fleet open‑source device‑management platform, provided by FleetDM. Because the vulnerability is triggered by an authenticated Observer role, any such user in a Fleet deployment affected by those versions can exploit it.

The CVSS score of 6.5 indicates a medium severity vulnerability. EPSS is not available, and the flaw is not listed in CISA KEV. The attack requires only an authenticated Observer role on a vulnerable Fleet instance, and the exploit uses standard API query parameters without needing local code execution or elevated system privileges. Once the certificate secrets are obtained, an attacker can impersonate a host and gain further access to Fleet’s osquery and Orbit endpoints. Therefore the risk is significant for environments where observer roles are granted broadly and where host secrets are valuable.