Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint

Summary The target search endpoint POST /api/latest/fleet/targets returned team enroll secrets and full team configuration, including credential-bearing agent options, to observer-class users. Other team-facing endpoints mask these fields for observers; the target search endpoint did not apply th...

GHSA-88P2-JJ8W-J8QG Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint

Summary The target search endpoint POST /api/latest/fleet/targets returned team enroll secrets and full team configuration, including credential-bearing agent options, to observer-class users. Other team-facing endpoints mask these fields for observers; the target search endpoint did not apply th...

PT-2026-75948

Summary The target search endpoint POST /api/latest/fleet/targets returned team enroll secrets and full team configuration, including credential-bearing agent options, to observer-class users. Other team-facing endpoints mask these fields for observers; the target search endpoint did not apply th...

PT-2026-76561

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.87.0 Description The target search endpoint POST /api/latest/fleet/targets fails to sanitize data for users with Observer, Observer+, or Technician roles. This allows these users to retrieve unmasked team enroll secre...

CVE-2026-19351

creationtimestamp| type| source ---|---|--- 2026-08-09 12:52:41+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3msnmvbvrda2j 2026-08-10 11:39:42+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3mspzbq3juj2w...

CVE-2026-71559

creationtimestamp| type| source ---|---|--- 2026-08-07 14:04:16+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3msipxh3dtl2d...

GHSA-CVHV-G4RQ-3HMW

creationtimestamp| type| source ---|---|--- 2026-08-04 14:30:44+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3msb7zzqhcc2s...

CVE-2026-18644

creationtimestamp| type| source ---|---|--- 2026-08-03 20:58:05+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3ms7f7qkfl32q...

CVE-2026-68979

creationtimestamp| type| source ---|---|--- 2026-08-03 20:53:33+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3ms7exnbdm52g 2026-08-04 01:52:04+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3ms7vng7zoz24...

CVE-2026-38446

creationtimestamp| type| source ---|---|--- 2026-08-03 20:41:22+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3ms7ebtfrsn2j...

CVE-2026-18573

creationtimestamp| type| source ---|---|--- 2026-08-02 10:08:30+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3ms3qhbd6vx2g...

CVE-2026-67344

creationtimestamp| type| source ---|---|--- 2026-08-01 15:20:24+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrzrg36jmq2d 2026-08-01 22:26:23+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3ms2j7rm62d25 2026-08-01 22:26:40+00:00| seen|...

CVE-2026-66415

creationtimestamp| type| source ---|---|--- 2026-07-30 20:00:35+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrva57i7jh2o 2026-07-30 20:22:29+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrvbe4xv6v2d...

CVE-2026-67595

VaahCMS versions 2.0.0–2.3.4 contain a malicious obfuscated JavaScript payload embedded in the security-otp.blade.php template used to render security OTP emails. The payload can run in any browser that renders the affected email with JavaScript enabled and establishes a WebSocket connection to a...

GHSA-X5VX-C2C8-M3W9

creationtimestamp| type| source ---|---|--- 2026-07-27 19:20:30+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrnmis3k5v2n...

CVE-2026-65015

creationtimestamp| type| source ---|---|--- 2026-07-27 19:20:30+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrnmis3k5v2n...

GHSA-35Q8-9MJ6-WJMF

creationtimestamp| type| source ---|---|--- 2026-07-27 19:18:57+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrnmfzh6ff2o...

GHSA-GPFC-H59V-63CV

creationtimestamp| type| source ---|---|--- 2026-07-25 17:51:14+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrigld2ef32d...

GHSA-8QQM-FP2Q-V734

creationtimestamp| type| source ---|---|--- 2026-07-23 23:59:46+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mre2ahctmm2e...

CVE-2026-44909

creationtimestamp| type| source ---|---|--- 2026-07-23 18:10:43+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrdgqdqney2c 2026-07-23 19:42:40+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrdluqw6m72f...