Vulnerability-Lookup

CVE-2026-48786 (GCVE-0-2026-48786)

Vulnerability from cvelistv5 – Published: 2026-08-26 18:25 – Updated: 2026-08-26 18:49

Title

Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint

Summary

Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint (POST /api/latest/fleet/targets) returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-class users. Other team-facing endpoints mask these fields for observers, but the target search endpoint did not apply the same sanitization, so an authenticated user with the Observer, Observer+, or Technician role, whether global or team-scoped, could retrieve the secrets and agent options by performing a target search against an observer-runnable query. With a leaked team enroll secret an attacker could enroll unauthorized hosts into the affected team, and if the team's agent options contained credentials such as AWS secret access keys or proxy passwords, those values were disclosed as well. This issue is fixed in version 4.87.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-26 18:48 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/fleetdm/fleet/security/advisor…	x_refsource_CONFIRM
https://github.com/fleetdm/fleet/releases/tag/fle…	x_refsource_MISC
http://github.com/fleetdm/fleet/commit/6a481477e8…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
fleetdm	fleet	Affected: < 4.87.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48786",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-26T18:48:23.482572Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-26T18:49:37.564Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "fleet",
          "vendor": "fleetdm",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.87.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint (POST /api/latest/fleet/targets) returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-class users. Other team-facing endpoints mask these fields for observers, but the target search endpoint did not apply the same sanitization, so an authenticated user with the Observer, Observer+, or Technician role, whether global or team-scoped, could retrieve the secrets and agent options by performing a target search against an observer-runnable query. With a leaked team enroll secret an attacker could enroll unauthorized hosts into the affected team, and if the team\u0027s agent options contained credentials such as AWS secret access keys or proxy passwords, those values were disclosed as well. This issue is fixed in version 4.87.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-26T18:25:09.971Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/fleetdm/fleet/security/advisories/GHSA-88p2-jj8w-j8qg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-88p2-jj8w-j8qg"
        },
        {
          "name": "https://github.com/fleetdm/fleet/releases/tag/fleet-v4.87.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/fleetdm/fleet/releases/tag/fleet-v4.87.0"
        },
        {
          "name": "http://github.com/fleetdm/fleet/commit/6a481477e8ac4bef43b5826e6240b867ac3b2379",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://github.com/fleetdm/fleet/commit/6a481477e8ac4bef43b5826e6240b867ac3b2379"
        }
      ],
      "source": {
        "advisory": "GHSA-88p2-jj8w-j8qg",
        "discovery": "UNKNOWN"
      },
      "title": "Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48786",
    "datePublished": "2026-08-26T18:25:09.971Z",
    "dateReserved": "2026-05-22T20:18:20.365Z",
    "dateUpdated": "2026-08-26T18:49:37.564Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-48786",
      "date": "2026-08-29",
      "epss": "0.00251",
      "percentile": "0.16375"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-48786\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-26T19:16:50.643\",\"lastModified\":\"2026-08-26T20:17:52.013\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint (POST /api/latest/fleet/targets) returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-class users. Other team-facing endpoints mask these fields for observers, but the target search endpoint did not apply the same sanitization, so an authenticated user with the Observer, Observer+, or Technician role, whether global or team-scoped, could retrieve the secrets and agent options by performing a target search against an observer-runnable query. With a leaked team enroll secret an attacker could enroll unauthorized hosts into the affected team, and if the team\u0027s agent options contained credentials such as AWS secret access keys or proxy passwords, those values were disclosed as well. This issue is fixed in version 4.87.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"fleetdm\",\"product\":\"fleet\",\"versions\":[{\"version\":\"\u003c 4.87.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-26T18:48:23.482572Z\",\"id\":\"CVE-2026-48786\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"references\":[{\"url\":\"http://github.com/fleetdm/fleet/commit/6a481477e8ac4bef43b5826e6240b867ac3b2379\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/fleetdm/fleet/releases/tag/fleet-v4.87.0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/fleetdm/fleet/security/advisories/GHSA-88p2-jj8w-j8qg\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-48786\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-26T18:48:23.482572Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-26T18:49:32.419Z\"}}], \"cna\": {\"title\": \"Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint\", \"source\": {\"advisory\": \"GHSA-88p2-jj8w-j8qg\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"fleetdm\", \"product\": \"fleet\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 4.87.0\"}]}], \"references\": [{\"url\": \"https://github.com/fleetdm/fleet/security/advisories/GHSA-88p2-jj8w-j8qg\", \"name\": \"https://github.com/fleetdm/fleet/security/advisories/GHSA-88p2-jj8w-j8qg\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/fleetdm/fleet/releases/tag/fleet-v4.87.0\", \"name\": \"https://github.com/fleetdm/fleet/releases/tag/fleet-v4.87.0\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"http://github.com/fleetdm/fleet/commit/6a481477e8ac4bef43b5826e6240b867ac3b2379\", \"name\": \"http://github.com/fleetdm/fleet/commit/6a481477e8ac4bef43b5826e6240b867ac3b2379\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint (POST /api/latest/fleet/targets) returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-class users. Other team-facing endpoints mask these fields for observers, but the target search endpoint did not apply the same sanitization, so an authenticated user with the Observer, Observer+, or Technician role, whether global or team-scoped, could retrieve the secrets and agent options by performing a target search against an observer-runnable query. With a leaked team enroll secret an attacker could enroll unauthorized hosts into the affected team, and if the team\u0027s agent options contained credentials such as AWS secret access keys or proxy passwords, those values were disclosed as well. This issue is fixed in version 4.87.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-26T18:25:09.971Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-48786\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-26T18:49:37.564Z\", \"dateReserved\": \"2026-05-22T20:18:20.365Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-08-26T18:25:09.971Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-48786

Vulnerability from fkie_nvd - Published: 2026-08-26 19:16 - Updated: 2026-08-26 20:17

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	http://github.com/fleetdm/fleet/commit/6a481477e8ac4bef43b5826e6240b867ac3b2379
	security-advisories@github.com	https://github.com/fleetdm/fleet/releases/tag/fleet-v4.87.0
	security-advisories@github.com	https://github.com/fleetdm/fleet/security/advisories/GHSA-88p2-jj8w-j8qg

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "fleet",
          "vendor": "fleetdm",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.87.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint (POST /api/latest/fleet/targets) returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-class users. Other team-facing endpoints mask these fields for observers, but the target search endpoint did not apply the same sanitization, so an authenticated user with the Observer, Observer+, or Technician role, whether global or team-scoped, could retrieve the secrets and agent options by performing a target search against an observer-runnable query. With a leaked team enroll secret an attacker could enroll unauthorized hosts into the affected team, and if the team\u0027s agent options contained credentials such as AWS secret access keys or proxy passwords, those values were disclosed as well. This issue is fixed in version 4.87.0."
    }
  ],
  "id": "CVE-2026-48786",
  "lastModified": "2026-08-26T20:17:52.013",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-48786",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-26T18:48:23.482572Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-26T19:16:50.643",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "http://github.com/fleetdm/fleet/commit/6a481477e8ac4bef43b5826e6240b867ac3b2379"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/fleetdm/fleet/releases/tag/fleet-v4.87.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-88p2-jj8w-j8qg"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-88P2-JJ8W-J8QG

Vulnerability from github – Published: 2026-08-12 15:18 – Updated: 2026-08-12 15:18

Summary

Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint

Details

Summary

The target search endpoint (POST /api/latest/fleet/targets) returned team enroll secrets and full team configuration, including credential-bearing agent options, to observer-class users. Other team-facing endpoints mask these fields for observers; the target search endpoint did not apply the same sanitization.

Impact

An authenticated user with Observer, Observer+, or Technician role (global or team-scoped) could retrieve unmasked team enroll secrets and team agent options by performing a target search against an observer-runnable query.

With a leaked team enroll secret, an attacker could enroll unauthorized hosts into the affected team. If the team's agent options contained credentials such as AWS secret access keys or proxy passwords, those values were also exposed.

Patches

v4.87.0

Workarounds

If an immediate upgrade is not possible, administrators should:

Rotate team enroll secrets for any team that may have been exposed
Rotate any credentials stored in team agent options (AWS keys, proxy passwords, session tokens)
Restrict Observer and Technician roles to fully trusted users until the patch is applied

Credits

Fleet thanks @fuzzztf for responsibly reporting this issue.

For more information

If there are any questions or comments about this advisory:

Send an email to security@fleetdm.com Join #fleet in osquery Slack

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/fleetdm/fleet/v4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.87.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-48786"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-12T15:18:13Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe target search endpoint (`POST /api/latest/fleet/targets`) returned team enroll secrets and full team configuration, including credential-bearing agent options, to observer-class users. Other team-facing endpoints mask these fields for observers; the target search endpoint did not apply the same sanitization.\n\n### Impact\n\nAn authenticated user with Observer, Observer+, or Technician role (global or team-scoped) could retrieve unmasked team enroll secrets and team agent options by performing a target search against an observer-runnable query.\n\nWith a leaked team enroll secret, an attacker could enroll unauthorized hosts into the affected team. If the team\u0027s agent options contained credentials such as AWS secret access keys or proxy passwords, those values were also exposed.\n\n### Patches\n\n- v4.87.0\n\n### Workarounds\n\nIf an immediate upgrade is not possible, administrators should:\n\n- Rotate team enroll secrets for any team that may have been exposed\n- Rotate any credentials stored in team agent options (AWS keys, proxy passwords, session tokens)\n- Restrict Observer and Technician roles to fully trusted users until the patch is applied\n\n### Credits\n\nFleet thanks @fuzzztf for responsibly reporting this issue.\n\n### For more information\n\nIf there are any questions or comments about this advisory:\n\nSend an email to [security@fleetdm.com](mailto:security@fleetdm.com)\nJoin #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)",
  "id": "GHSA-88p2-jj8w-j8qg",
  "modified": "2026-08-12T15:18:13Z",
  "published": "2026-08-12T15:18:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-88p2-jj8w-j8qg"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fleetdm/fleet"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fleetdm/fleet/releases/tag/fleet-v4.87.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-48786 (GCVE-0-2026-48786)

FKIE_CVE-2026-48786

GHSA-88P2-JJ8W-J8QG

Summary

Impact

Patches

Workarounds

Credits

For more information

Tags

Sightings

Nomenclature