CVE-2026-46371: Fleet MDM Information Disclosure Vulnerability

CVE-2026-46371 Overview

CVE-2026-46371 affects Fleet, an open-source device management platform built on osquery. The vulnerability resides in the Apple Mobile Device Management (MDM) commands listing endpoint at GET /api/v1/fleet/mdm/apple/commands. An authenticated user with the lowest-privilege Observer role can exploit an unvalidated order_key parameter to exfiltrate sensitive database values through a sort-order oracle. Extractable data includes host enrollment secrets and Apple Push Notification Service (APNS) tokens. The issue affects versions up to and including 4.84.1 and is resolved in version 4.84.2.

Critical Impact
Attackers can extract node_key and orbit_node_key values to impersonate enrolled hosts, submit fabricated host data, and retrieve pending scripts and commands from Fleet.

Affected Products

Fleet versions up to and including 4.84.1
Fleet Apple MDM commands listing endpoint
Fleet osquery and Orbit host endpoints (post-exploitation impact)

Discovery Timeline

2026-08-26 - CVE-2026-46371 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-46371

Vulnerability Analysis

The vulnerability is a SQL injection issue [CWE-89] manifesting as a sort-order oracle. The GET /api/v1/fleet/mdm/apple/commands endpoint accepts a user-supplied order_key parameter without validating it against a column allowlist. The underlying database query joins the hosts and nano_enrollments tables, exposing sensitive columns to sort operations.

An attacker sets order_key to a sensitive field such as node_key, orbit_node_key, or APNS token columns. By combining the sort column with the cursor-based after parameter, the attacker performs a binary search across possible character values. The presence or absence of results in the response reveals each character of the target value, even though the sensitive value itself never appears in the response body.

An Observer role, the lowest-privilege authenticated role in Fleet, is sufficient to invoke the endpoint. The extracted secrets enable host impersonation against Fleet's osquery and Orbit endpoints.

Root Cause

The endpoint fails to validate the order_key parameter against an allowlist of permitted sort columns. This missing input validation allows arbitrary column names from joined tables to be used in the ORDER BY clause of the constructed SQL query.

Attack Vector

Exploitation requires network access to the Fleet API and authenticated credentials with at least the Observer role. The attacker issues repeated requests to GET /api/v1/fleet/mdm/apple/commands, manipulating the order_key and after cursor parameters to perform character-by-character binary search extraction of secrets from the hosts and nano_enrollments tables. Post-exploitation, the attacker uses the extracted node_key or orbit_node_key values to authenticate as enrolled hosts and interact with Fleet's agent-facing endpoints.

Exploitation is described in prose. No verified proof-of-concept code is available at this time.
See the GitHub Security Advisory for further technical details.

Detection Methods for CVE-2026-46371

Indicators of Compromise

High-volume requests from a single authenticated session to /api/v1/fleet/mdm/apple/commands with varying order_key and after cursor values
Requests containing order_key values matching sensitive column names such as node_key, orbit_node_key, or APNS token fields
Unexpected host check-ins to Fleet's osquery or Orbit endpoints from IP addresses that do not correspond to the enrolled device history

Detection Strategies

Inspect Fleet application and reverse-proxy access logs for anomalous query-string patterns on the MDM commands endpoint
Alert on Observer-role sessions issuing large numbers of paginated requests against MDM administrative endpoints
Correlate host enrollment activity with source IP and geolocation drift to detect impersonation via stolen node_key values

Monitoring Recommendations

Enable verbose API access logging on the Fleet server and forward logs to a centralized analytics platform
Baseline normal Observer-role API usage and alert on deviations in request rate or endpoint diversity
Monitor nano_enrollments and hosts table access patterns at the database layer where feasible

How to Mitigate CVE-2026-46371

Immediate Actions Required

Upgrade Fleet to version 4.84.2 or later, which enforces a column allowlist on the order_key parameter
Rotate all host enrollment secrets, node_key values, orbit_node_key values, and APNS tokens after upgrading
Audit Observer-role accounts and revoke unused or unnecessary API tokens

Patch Information

Fleet version 4.84.2 fixes the vulnerability by validating the order_key parameter against an allowlist of permitted sort columns. Details are published in the Fleet GitHub Security Advisory GHSA-x4qr-qw6h-wvxq.

Workarounds

Restrict network access to the Fleet API to trusted administrative networks until the patch is applied
Temporarily suspend Observer-role accounts that do not require access to MDM data
Deploy a web application firewall (WAF) rule that rejects requests to /api/v1/fleet/mdm/apple/commands containing non-allowlisted order_key values

bash

# Example WAF rule concept - reject non-allowlisted order_key values
# Adjust the allowlist to match your Fleet deployment
if ($request_uri ~* "/api/v1/fleet/mdm/apple/commands" ) {
  if ($arg_order_key !~* "^(created_at|updated_at|command_uuid|status)$") {
    return 403;
  }
}