CVE-2026-46370
Received Received - Intake

Fleet Device Management Platform Node Key Exposure via Sort-Order Oracle

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: GitHub, Inc.

Description
Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoint (GET /api/v1/fleet/labels/{id}/hosts) allowed an authenticated user with the lowest-privilege Observer role to extract host enrollment secrets through a sort-order oracle. The endpoint accepted a user-supplied order_key parameter that was not validated against a column allowlist, so an attacker with Global or Team Observer access could set the sort column to a sensitive field such as h.node_key and combine it with the cursor-based after parameter to binary-search the value one character at a time; the targeted value never appeared in the response, but the presence or absence of results revealed each character. Because node_key and orbit_node_key are the long-lived shared secrets that osquery and Orbit agents use to authenticate to the Fleet server, an attacker who reconstructed them could impersonate enrolled hosts, submit fabricated query results and inventory, retrieve pending scripts and MDM commands, and poison compliance and policy results across the deployment. This issue is fixed in version 4.84.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-46370

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
fleet fleet to 4.84.1 (inc)
fleet fleet 4.84.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Fleet versions up to 4.84.1 have a vulnerability in the labels host-listing endpoint (GET /api/v1/fleet/labels/{id}/hosts). An authenticated user with the Observer role could exploit a sort-order parameter to extract host enrollment secrets like node_key and orbit_node_key. By manipulating the order_key parameter to target sensitive fields and using cursor-based pagination, an attacker could perform a binary search to reconstruct these secrets through the presence or absence of results.

Detection Guidance

To detect this vulnerability, check Fleet server logs for suspicious API requests to the labels host-listing endpoint (GET /api/v1/fleet/labels/{id}/hosts) with unusual order_key parameters like h.node_key or orbit_node_key. Monitor for repeated requests with cursor-based after parameters that may indicate binary-search attempts.

Impact Analysis

If exploited, this vulnerability allows an attacker to impersonate enrolled hosts, submit fake query results and inventory data, retrieve pending scripts and MDM commands, and manipulate compliance and policy results. This could lead to unauthorized access, data integrity issues, and misleading security assessments across the Fleet deployment.

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive host data and allowing attackers to manipulate compliance reports. Exposure of enrollment secrets could lead to unauthorized device control, data breaches, and compromised audit trails, violating data protection and security requirements.

Mitigation Strategies

Upgrade Fleet to version 4.84.2 or later immediately. Review user roles and permissions to ensure only necessary access is granted. Rotate all host enrollment secrets (node_key and orbit_node_key) for enrolled devices to invalidate any potential stolen credentials.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46370. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart