CVE-2026-46370: Fleet Package Observer-Level Enrollment Secret Extraction Vulnerability
Summary
CVE-2026-46370: A vulnerability in Fleet's labels host-listing endpoint allowed authenticated users with the lowest-privilege Observer role to extract host enrollment secrets (node_key, orbit_node_key) through a cursor-based binary sear... Affects github.com/fleetdm/fleet/v4 versions < 4.84.2. Fixed in 4.84.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fleet is an open-source tool designed for managing and monitoring fleets of devices using osquery. It allows users to query and manage data from various endpoints, providing insights into system performance, security, and compliance. The package is widely used for its ability to streamline device management and enhance security posture. However, it has a vulnerability that exposes sensitive information due to improper handling of user-supplied parameters.
Vulnerability Detail
A vulnerability in Fleet's labels host-listing endpoint allows authenticated users with the Observer role to extract sensitive host enrollment secrets, such as node_key and orbit_node_key, through a cursor-based binary search oracle. The issue arises from the endpoint's acceptance of an unvalidated user-supplied order_key parameter, which can be manipulated to access sensitive columns in a joined table. Attackers can exploit this vulnerability to impersonate hosts, submit false data, and compromise the integrity of the Fleet deployment.
How To Fix
Latest published version: v4.43.4 as of 23 Oct 2026
go get github.com/fleetdm/fleet/v4@v4.43.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.84.2
This is the first release that contains the fix.
go get github.com/fleetdm/fleet/v4@v4.84.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate upgrade is not feasible, restrict the Observer role to fully trusted users until the patch is applied. Additionally, rotate the node_key and orbit_node_key for any hosts suspected of exposure by re-enrolling the affected hosts.
Conclusion
CVE-2026-46370 presents a significant risk to Fleet deployments by allowing unauthorized access to sensitive host enrollment secrets. It is crucial for administrators to apply the patch or implement workarounds to mitigate the risk of exploitation. Regular monitoring and updating of open-source dependencies are essential for maintaining security.
See every vulnerability recorded for github.com/fleetdm/fleet/v4 →
FAQ
CVE-2026-46370 is a vulnerability in the Fleet package that allows low-privilege users to extract sensitive host enrollment secrets.
node_key and orbit_node_key are long-lived shared secrets used by osquery and Orbit agents to authenticate to the Fleet server.
Authenticated users with Observer roles in Fleet deployments are potentially affected, especially if they are not fully trusted.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 6.5, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/fleetdm/fleet/v4.
