CVE-2026-48786

Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint (POST /api/latest/fleet/targets) returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-class users. Other team-facing endpoints mask these fields for observers, but the target search endpoint did not apply the same sanitization, so an authenticated user with the Observer, Observer+, or Technician role, whether global or team-scoped, could retrieve the secrets and agent options by performing a target search against an observer-runnable query. With a leaked team enroll secret an attacker could enroll unauthorized hosts into the affected team, and if the team's agent options contained credentials such as AWS secret access keys or proxy passwords, those values were disclosed as well. This issue is fixed in version 4.87.0.

• CWE-200

• https://github.com/fleetdm/fleet/commit/6a481477e8ac4bef43b5826e6240b867ac3b2379
• https://github.com/fleetdm/fleet/releases/tag/fleet-v4.87.0
• https://github.com/fleetdm/fleet/security/advisories/GHSA-88p2-jj8w-j8qg

Published

Aug 26, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48780Forem is open source software for building communities. Prio…8.2
• CVE-2026-48781Postiz is an AI social media scheduling tool. In versions pr…9.9
• CVE-2026-48782Pydantic AI is a Python agent framework for building applica…6.8
• CVE-2026-48783Postiz is an AI social media scheduling tool. Versions prior…4.8
• CVE-2026-48784Symfony is a PHP framework for web and console applications …6.1
• CVE-2026-48785Apptainer is an open source container platform. Prior to ver…4.8
• CVE-2026-48787gin-vue-admin is an AI-assisted basic development platform. …7.4
• CVE-2026-48788Remark42 is a self-hosted comment engine for blogs, articles…8.2
• CVE-2026-48789AnythingLLM is an application that turns pieces of content i…4.3
• CVE-2026-4879GitLab has remediated an issue in GitLab EE affecting all ve…4.3
• CVE-2026-48790Turso CLI is the command line interface (CLI) to the open-so…5.5
• CVE-2026-48791sigstore-java is a sigstore java client for interacting with…2