CVE-2026-46370

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.85.0

Description Authenticated users with the lowest-privilege Observer role can extract host enrollment secrets, specifically node key and orbit node key, using a cursor-based binary search oracle. The issue exists in the GET /api/v1/fleet/labels/{id}/hosts endpoint, which uses a deprecated helper that fails to restrict columns in the ORDER BY clause. By supplying a sensitive column name as the order key parameter and utilizing the after parameter, an attacker can determine the values of these secrets character by character based on the presence or absence of results. These secrets are used by osquery and Orbit agents to authenticate to the server, and their exposure allows an attacker to impersonate hosts, submit fabricated data, retrieve pending scripts or MDM commands, and poison compliance results.

Recommendations Update to version 4.85.0. Restrict the Observer role to fully trusted users. Rotate node key and orbit node key by re-enrolling any hosts suspected of exposure.