CVE-2026-41262

Received Received - Intake

Fleet Policy Information Disclosure via Team Isolation Bypass

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: GitHub, Inc.

Description

Fleet is an open-source device management platform built on osquery. In versions prior to 4.85.0, the global policy read endpoint (GET /api/latest/fleet/policies/{policy_id}) fails to verify team ownership of the requested policy, allowing an authenticated user with observer-level access on any single team to read the full details of policies belonging to any other team and bypass Fleet's team isolation model. The handler authorizes the request against an empty policy object whose TeamID is nil, which an authorization rule permits for any user holding a role on any team, and then fetches the policy by ID with no team filter and returns it without any post-fetch scope check. Because policy IDs are sequential integers, an attacker can enumerate them to read other teams' policy SQL queries, host pass and fail counts, and associated software-installer and script metadata, exposing security-monitoring strategies and compliance posture across team boundaries. This issue is fixed in version 4.85.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-41262

Affected Vendors & Products

Vendor	Product	Version / Range
fleet	fleet	4.85.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability affects Fleet, an open-source device management platform. It allows an authenticated observer-level user on any team to read policies belonging to other teams by exploiting a flaw in the global policy read endpoint. The endpoint fails to verify team ownership, enabling unauthorized access to sensitive policy details such as SQL queries, host metrics, and compliance-related data.

Detection Guidance

This vulnerability can be detected by checking the Fleet server version. If your version is prior to 4.85.0, the system is vulnerable. Use the command: fleetctl version to check the installed version.

Impact Analysis

If you use Fleet, an attacker with observer access could read policies from other teams, exposing security monitoring strategies, compliance posture, and sensitive metadata. This could lead to information leaks, compromised security controls, or violations of internal policies. The impact is higher in multi-team environments where team isolation is critical.

Compliance Impact

This vulnerability could lead to compliance violations by exposing sensitive data across team boundaries. For GDPR, it may result in unauthorized access to personal data or security measures. For HIPAA, it could compromise protected health information if policies contain related monitoring details. Organizations must ensure team isolation to meet regulatory requirements.

Mitigation Strategies

Upgrade Fleet to version 4.85.0 or later immediately to address the vulnerability. This version includes the fix for the policy read endpoint authorization issue.

Hi! I’m here to help you understand CVE-2026-41262. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70