CVE-2026-27465: Fleet Information Disclosure Vulnerability

CVE-2026-27465 Overview

Fleet is open source device management software. A vulnerability in Fleet's configuration API could expose Google Calendar service account credentials to authenticated users with low-privilege roles. This may allow unauthorized access to Google Calendar resources associated with the service account.

Fleet returns configuration data through an API endpoint that is accessible to authenticated users, including those with the lowest-privilege "Observer" role. In affected versions, Google Calendar service account credentials were not properly obfuscated before being returned. As a result, a low-privilege user could retrieve the service account's private key material. Depending on how the Google Calendar integration is configured, this could allow unauthorized access to calendar data or other Google Workspace resources associated with the service account.

Critical Impact

Low-privilege authenticated users can obtain Google Calendar service account private key material, potentially enabling unauthorized access to Google Workspace resources.

Affected Products

• Fleet versions prior to 4.80.1

Discovery Timeline

• 2026-02-26 - CVE CVE-2026-27465 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-27465

Vulnerability Analysis

This vulnerability is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data). The core issue stems from improper handling of sensitive credential data within Fleet's configuration API responses.

When authenticated users query Fleet's configuration endpoint, the system returns configuration data that should be sanitized before transmission. However, in versions prior to 4.80.1, the Google Calendar service account credentials were included in API responses without proper obfuscation or redaction. This means that even users with the most restrictive "Observer" role could access the complete private key material for the Google Calendar service account.

The exposure is limited to authenticated users within the Fleet environment. This issue does not allow escalation of privileges within Fleet or access to device management functionality. However, the leaked credentials could be used to access external Google Workspace resources depending on the permissions granted to the compromised service account.

Root Cause

The root cause is insufficient data sanitization in Fleet's configuration API endpoint. When building API responses containing integration configuration data, the application failed to redact or obfuscate the Google Calendar service account credentials before returning them to authenticated users. This represents a violation of the principle of least privilege, as low-privilege users have no legitimate need to access raw service account credentials.

Attack Vector

The attack vector is network-based and requires low-privilege authentication. An attacker would need valid credentials for any Fleet user account, including the most restricted "Observer" role. Once authenticated, the attacker can query the configuration API endpoint to retrieve the unredacted Google Calendar service account credentials. The attacker could then use these credentials to:

1. Access calendar data for users within the Google Workspace organization
2. Potentially access other Google Workspace resources depending on the service account's configured permissions
3. Persist access to Google Workspace resources even after their Fleet account is revoked

The attack does not require user interaction and can be executed with low complexity once authenticated access is obtained. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-27465

Indicators of Compromise

• Unusual API requests to Fleet configuration endpoints from low-privilege user accounts
• Access to Google Calendar service account credentials by users who should not require them
• Unexpected authentication activity from the Google Calendar service account in Google Workspace audit logs
• Calendar data access patterns that don't match expected integration behavior

Detection Strategies

• Monitor Fleet API access logs for configuration endpoint queries from Observer-role accounts
• Review Google Workspace Admin Console for unusual service account authentication events
• Audit Google Calendar API access logs for requests originating from unexpected IP addresses or geographic locations
• Implement alerting for configuration API access patterns that deviate from normal operational baselines

Monitoring Recommendations

• Enable detailed logging for Fleet's configuration API endpoints
• Configure Google Workspace alerting for service account credential usage anomalies
• Implement user behavior analytics to detect unusual API access patterns from low-privilege accounts
• Review Google Cloud audit logs for the affected service account regularly

How to Mitigate CVE-2026-27465

Immediate Actions Required

• Upgrade Fleet to version 4.80.1 or later immediately
• Rotate all Google Calendar service account credentials that were configured in affected Fleet versions
• Review Google Workspace audit logs to identify any unauthorized access using the compromised credentials
• Audit Fleet user accounts to identify any suspicious activity or unauthorized Observer-role accounts

Patch Information

Fleet version 4.80.1 addresses this vulnerability by properly obfuscating Google Calendar service account credentials before returning configuration data through API responses. Organizations should upgrade to this version or later as soon as possible. Additional details are available in the GitHub Security Advisory.

Workarounds

• If an immediate upgrade is not possible, remove the Google Calendar integration from Fleet temporarily
• Rotate the affected Google service account credentials after removing the integration
• Restrict network access to Fleet's configuration API endpoints to only trusted administrative networks
• Consider implementing additional authentication controls or API gateway restrictions for sensitive Fleet endpoints