CVE-2026-46370

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoint (GET /api/v1/fleet/labels/{id}/hosts) allowed an authenticated user with the lowest-privilege Observer role to extract host enrollment secrets through a sort-order oracle. The endpoint accepted a user-supplied order_key parameter that was not validated against a column allowlist, so an attacker with Global or Team Observer access could set the sort column to a sensitive field such as h.node_key and combine it with the cursor-based after parameter to binary-search the value one character at a time; the targeted value never appeared in the response, but the presence or absence of results revealed each character. Because node_key and orbit_node_key are the long-lived shared secrets that osquery and Orbit agents use to authenticate to the Fleet server, an attacker who reconstructed them could impersonate enrolled hosts, submit fabricated query results and inventory, retrieve pending scripts and MDM commands, and poison compliance and policy results across the deployment. This issue is fixed in version 4.84.2.

• CWE-89
• CWE-200

• https://github.com/fleetdm/fleet/security/advisories/GHSA-vxm7-9x8v-8gm4

Published

Aug 26, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46365phpMyFAQ before 4.1.2 contains a missing authorization vulne…5.4
• CVE-2026-46366phpMyFAQ before 4.1.2 contains an information disclosure vul…8.7
• CVE-2026-46367phpMyFAQ before 4.1.2 contains a stored cross-site scripting…8.3
• CVE-2026-46368luci-app-https-dns-proxy through 2025.12.29-5 — an optional …8.8
• CVE-2026-46369Nimiq is a Rust implementation of the Nimiq Proof-of-Stake p…7.5
• CVE-2026-4637Paessler PRTG Network Monitor before version 26.2.120.1449 i…5.1
• CVE-2026-46371Fleet is an open-source device management platform built on …6.5
• CVE-2026-46372SillyTavern is a locally installed user interface that allow…8.5
• CVE-2026-46373SQLFluff is a modular SQL linter and auto-formatter with sup…7.5
• CVE-2026-46374SQLFluff is a modular SQL linter and auto-formatter with sup…7.5
• CVE-2026-46376FreePBX is an open source IP PBX. From 15.0.42 to before 16.…9.8
• CVE-2026-46377Dasel is a command-line tool and library for querying, modif…6.2