CVE-2026-46370: Fleet Device Management Information Disclosure

CVE-2026-46370 Overview

CVE-2026-46370 is a blind SQL injection-style oracle vulnerability in Fleet, an open-source device management platform built on osquery. The flaw exists in the labels host-listing endpoint GET /api/v1/fleet/labels/{id}/hosts in versions up to and including 4.84.1. Authenticated users with the lowest-privilege Observer role can extract host enrollment secrets by abusing an unvalidated order_key parameter. The vulnerability is fixed in version 4.84.2.

Critical Impact
An attacker who reconstructs node_key or orbit_node_key values can impersonate enrolled hosts, submit fabricated inventory, retrieve pending scripts and MDM commands, and poison compliance results across the deployment.

Affected Products

Fleet device management platform versions up to and including 4.84.1
Fleet osquery agent enrollment (node_key)
Fleet Orbit agent enrollment (orbit_node_key)

Discovery Timeline

2026-08-26 - CVE-2026-46370 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-46370

Vulnerability Analysis

The labels host-listing endpoint accepts a user-supplied order_key parameter that determines the SQL sort column. Fleet does not validate this parameter against a column allowlist. An authenticated Observer can specify sensitive columns such as h.node_key or h.orbit_node_key as the sort key.

By combining the sort column with the cursor-based after parameter, an attacker performs a binary search across the sorted result set. The sensitive value never appears in the response body. Instead, the presence or absence of records after a supplied cursor value reveals whether the target character is greater or less than the guess.

Repeating this comparison character by character reconstructs the full secret. The attack works for any Global or Team Observer, which is the lowest-privilege authenticated role in Fleet. This classifies the flaw as an improper neutralization of special elements in SQL commands [CWE-89].

Root Cause

The root cause is missing input validation on the order_key query parameter. The endpoint passes the parameter directly into the ORDER BY clause of the underlying host query without checking it against a fixed list of permitted columns. This design permits an authenticated user to influence sort behavior against columns that should never be exposed to Observer-level accounts.

Attack Vector

The attacker authenticates to Fleet as a Global or Team Observer. They then issue repeated requests to GET /api/v1/fleet/labels/{id}/hosts with order_key=h.node_key and varying after cursor values. Each response indicates whether hosts exist with a node_key greater than the supplied cursor. The attacker performs a character-by-character binary search to recover the full secret.

Once node_key or orbit_node_key is recovered, the attacker authenticates to the Fleet server as that host. They can submit fabricated osquery results, retrieve queued scripts, retrieve MDM commands, and manipulate policy compliance state.

See the GitHub Security Advisory GHSA-vxm7-9x8v-8gm4 for technical details.

Detection Methods for CVE-2026-46370

Indicators of Compromise

Repeated requests to GET /api/v1/fleet/labels/{id}/hosts from a single Observer account with varying after parameter values
Requests where order_key references sensitive columns such as h.node_key, h.orbit_node_key, or other non-display fields
Sudden host check-ins from IP addresses inconsistent with the enrolled device's historical origin
Osquery result submissions or inventory updates that conflict with prior host telemetry

Detection Strategies

Parse Fleet API access logs for order_key values outside the expected allowlist of display columns
Alert when a single authenticated session issues a high volume of label-host requests with incrementally changing after values
Correlate Fleet host check-in source IPs against baseline enrollment IPs and geolocation history

Monitoring Recommendations

Enable verbose Fleet audit logging and forward records to a central log platform for retention and analysis
Track authentication events tied to Observer accounts and flag anomalous query patterns against the labels endpoint
Monitor osquery and Orbit agent check-in cadence for duplicate or off-schedule submissions that could indicate impersonation

How to Mitigate CVE-2026-46370

Immediate Actions Required

Upgrade Fleet to version 4.84.2 or later, which enforces a column allowlist on the order_key parameter
Rotate all host enrollment secrets, including node_key and orbit_node_key, and re-enroll affected osquery and Orbit agents
Audit Observer-role accounts and revoke access for any unused or unrecognized identities
Review Fleet API logs for prior exploitation attempts targeting order_key with sensitive column names

Patch Information

The issue is fixed in Fleet version 4.84.2. The upstream fix validates the order_key parameter against a defined allowlist of sortable columns and rejects requests referencing sensitive fields. Refer to the GitHub Security Advisory GHSA-vxm7-9x8v-8gm4 for full remediation guidance.

Workarounds

Restrict Observer role assignment and remove access for accounts that do not require host visibility until upgrading
Place an API gateway or reverse proxy in front of Fleet that filters requests where order_key contains column names outside the display allowlist
Rate-limit requests to /api/v1/fleet/labels/{id}/hosts per authenticated session to raise the cost of a binary-search oracle attack

bash

# Configuration example: block sensitive order_key values at a reverse proxy
# NGINX example
location /api/v1/fleet/labels/ {
    if ($arg_order_key ~* "node_key|orbit_node_key|secret|token") {
        return 403;
    }
    proxy_pass http://fleet_backend;
}