CVE-2026-41262: Fleet Device Management Auth Bypass Flaw

CVE-2026-41262 Overview

CVE-2026-41262 is a broken authorization vulnerability [CWE-863] in Fleet, an open-source device management platform built on osquery. In versions prior to 4.85.0, the global policy read endpoint GET /api/latest/fleet/policies/{policy_id} fails to verify team ownership of the requested policy. An authenticated user with observer-level access on any single team can read policy details belonging to any other team, bypassing Fleet's team isolation model. The exposed data includes policy SQL queries, host pass and fail counts, and associated software-installer and script metadata. This issue is fixed in Fleet version 4.85.0.

Critical Impact
Any authenticated observer on any team can enumerate sequential policy IDs and read every team's security-monitoring queries and compliance posture.

Affected Products

Fleet device management platform, all versions prior to 4.85.0
Fleet deployments exposing the /api/latest/fleet/policies/{policy_id} endpoint
Multi-team Fleet instances that rely on role-based team isolation

Discovery Timeline

2026-08-26 - CVE-2026-41262 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-41262

Vulnerability Analysis

The flaw resides in Fleet's global policy read handler. When a client requests a specific policy by ID, the handler builds an authorization decision against an empty policy object whose TeamID field is nil. Fleet's authorization rule permits this check for any user holding a role on any team, so an observer on a single team passes the gate. The handler then retrieves the policy record by primary key without applying a team filter and returns the full object to the caller. No post-fetch scope validation reconciles the fetched policy's TeamID with the caller's team membership.

Because policy IDs are sequential integers, an attacker walks the ID space to enumerate every policy in the deployment. The exposed fields include the policy's underlying osquery SQL, pass and fail host counts, and metadata for linked software installers and scripts. This data reveals the security-monitoring strategy and compliance posture of tenants that should remain isolated.

Root Cause

The root cause is a missing object-level ownership check after data retrieval. The authorization layer evaluates a placeholder object rather than the resolved resource. The database access path lacks a team-scoped WHERE clause, and no defense-in-depth check runs before the response is serialized.

Attack Vector

Exploitation requires an authenticated session with observer role on at least one team. The attacker issues sequential GET requests against /api/latest/fleet/policies/{policy_id} and parses the JSON responses. No user interaction, elevated privilege, or lateral movement is required. See the GitHub Security Advisory GHSA-gm7f-v959-fr2g for vendor details.

Detection Methods for CVE-2026-41262

Indicators of Compromise

Sequential GET requests to /api/latest/fleet/policies/{policy_id} from a single authenticated session
Access patterns where an observer's team membership does not match the returned policy's TeamID
High request volume against the policies endpoint from non-administrative accounts

Detection Strategies

Correlate Fleet API access logs against user team assignments to flag cross-team policy reads
Alert on enumeration behavior, such as monotonic policy ID access from one token within a short window
Baseline observer-role API activity and flag deviations that touch policy endpoints outside assigned teams

Monitoring Recommendations

Enable verbose audit logging on the Fleet API tier and forward logs to a centralized SIEM
Monitor observer accounts for read volume spikes against /api/latest/fleet/policies/
Review authentication token usage for anomalous geographic or client fingerprint changes

How to Mitigate CVE-2026-41262

Immediate Actions Required

Upgrade all Fleet instances to version 4.85.0 or later
Audit observer and team-role accounts and revoke unused API tokens
Rotate any API tokens that may have been used to enumerate policies during the exposure window
Review policy SQL and software-installer metadata for sensitive content that should be rewritten

Patch Information

Fleet version 4.85.0 fixes the missing team ownership check on the global policy read endpoint. Release artifacts and changelog are available at the Fleet v4.85.0 release page. Deployments running earlier 4.x versions must upgrade to receive the fix.

Workarounds

Restrict network access to the Fleet API to trusted administrative networks until the upgrade is applied
Temporarily downgrade or suspend observer accounts that do not require active use
Place a reverse proxy rule in front of Fleet to block direct requests to /api/latest/fleet/policies/{id} for non-admin sessions

bash

# Verify installed Fleet version and upgrade
fleetctl --version

# Docker deployment: pull the fixed image
docker pull fleetdm/fleet:v4.85.0
docker stop fleet && docker rm fleet
docker run -d --name fleet fleetdm/fleet:v4.85.0