CVE-2026-41262

Fleet is an open-source device management platform built on osquery. In versions prior to 4.85.0, the global policy read endpoint GET /api/latest/fleet/policies/policyid fails to verify team ownership of the requested policy, allowing an authenticated user with observer-level access on any single...

CVE-2026-41262

Fleet (open-source device management platform) versions prior to 4.85.0 contain an authorization bypass in the global policy read endpoint. The GetPolicyByIDQueries handler authorizes against an empty policy object with a nil TeamID, which the OPA policy rule permits for any user holding a role o...

CVE-2026-48786

Fleet , an open-source device management platform built on osquery, has an information disclosure flaw in the target search endpoint (POST /api/latest/fleet/targets). Prior to v4.87.0 , this endpoint failed to mask team enroll secrets and full team configuration (including credential-bearing agen...

CVE-2026-48786 Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint

Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint POST /api/latest/fleet/targets returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-clas...

Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint

Summary The global policy read endpoint GET /api/latest/fleet/policies/policyid performs authorization against an empty fleet.Policy struct with nil TeamID, then fetches any policy by ID from the database without verifying the fetched policy actually belongs to the global scope. This allows a use...

GHSA-GM7F-V959-FR2G Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint

Summary The global policy read endpoint GET /api/latest/fleet/policies/policyid performs authorization against an empty fleet.Policy struct with nil TeamID, then fetches any policy by ID from the database without verifying the fetched policy actually belongs to the global scope. This allows a use...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the orderkey parameter in the Apple MDM commands endpoint. An attacker can extract sensitive values from joined database tables, such as enrollment secrets and APNS tokens, by performing a binary search oracle attack...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the orderkey parameter in the Apple MDM commands endpoint. An attacker can extract sensitive values from joined database tables, such as enrollment secrets and APNS tokens, by performing a binary search oracle attack...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the orderkey parameter in the Apple MDM commands endpoint. An attacker can extract sensitive values from joined database tables, such as enrollment secrets and APNS tokens, by performing a binary search oracle attack...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the orderkey parameter in the Apple MDM commands endpoint. An attacker can extract sensitive values from joined database tables, such as enrollment secrets and APNS tokens, by performing a binary search oracle attack...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the orderkey parameter in the labels host-listing endpoint. An attacker can extract sensitive enrollment secrets by manipulating the sort order and leveraging a cursor-based binary search oracle. This is only exploitab...

GHSA-VXM7-9X8V-8GM4 Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint

Summary A vulnerability in Fleet's labels host-listing endpoint allowed authenticated users with the lowest-privilege Observer role to extract host enrollment secrets nodekey, orbitnodekey through a cursor-based binary search oracle. The endpoint accepted a user-supplied orderkey parameter that w...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the orderkey parameter in the labels host-listing endpoint. An attacker can extract sensitive enrollment secrets by manipulating the sort order and leveraging a cursor-based binary search oracle. This is only exploitab...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the orderkey parameter in the labels host-listing endpoint. An attacker can extract sensitive enrollment secrets by manipulating the sort order and leveraging a cursor-based binary search oracle. This is only exploitab...