CVE-2026-48786

Received Received - Intake

Information Disclosure in Fleet Device Management Platform

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: GitHub, Inc.

Description

Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint (POST /api/latest/fleet/targets) returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-class users. Other team-facing endpoints mask these fields for observers, but the target search endpoint did not apply the same sanitization, so an authenticated user with the Observer, Observer+, or Technician role, whether global or team-scoped, could retrieve the secrets and agent options by performing a target search against an observer-runnable query. With a leaked team enroll secret an attacker could enroll unauthorized hosts into the affected team, and if the team's agent options contained credentials such as AWS secret access keys or proxy passwords, those values were disclosed as well. This issue is fixed in version 4.87.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-08-26

Generated

2026-08-27

AI Q&A

2026-08-27

EPSS Evaluated

N/A

NVD

CVE-2026-48786

Affected Vendors & Products

Vendor	Product	Version / Range
fleet	fleet	to 4.87.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

Fleet is a device management platform. In versions before 4.87.0, the target search endpoint exposed unmasked team enroll secrets and full team configurations to low-privilege users with Observer, Observer+, or Technician roles. This allowed these users to retrieve sensitive credentials and agent options by searching targets.

Detection Guidance

Check Fleet server logs for unusual target search queries from observer-class users. Review API access logs for POST requests to /api/latest/fleet/targets with observer roles. Verify if team enroll secrets or agent options were exposed in responses.

Impact Analysis

An attacker with observer-level access could leak team enroll secrets and agent credentials like AWS keys or proxy passwords. This enables unauthorized host enrollment into the affected team and potential misuse of disclosed credentials for further attacks.

Compliance Impact

This vulnerability could lead to unauthorized access and data exposure, violating confidentiality requirements in GDPR and HIPAA. Unauthorized host enrollment and credential leaks may result in non-compliance with security and privacy controls mandated by these regulations.

Mitigation Strategies

Upgrade Fleet to version 4.87.0 or later immediately. Rotate all exposed team enroll secrets and agent credentials. Review and restrict observer-class user permissions. Audit API logs for past unauthorized access.

Hi! I’m here to help you understand CVE-2026-48786. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70