CVE-2026-48786: Fleet Device Management Information Disclosure

CVE-2026-48786 Overview

CVE-2026-48786 is an information disclosure vulnerability in Fleet, an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint POST /api/latest/fleet/targets returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-class users. Other team-facing endpoints correctly mask these fields for observers, but the target search endpoint did not apply the same sanitization. Authenticated users holding the Observer, Observer+, or Technician role could retrieve secrets and agent options by performing a target search against an observer-runnable query. The issue is fixed in Fleet 4.87.0.

Critical Impact
A leaked team enroll secret allows an attacker to enroll unauthorized hosts into the affected team. If agent options contained credentials such as AWS secret access keys or proxy passwords, those values were also disclosed.

Affected Products

Fleet device management platform, versions prior to 4.87.0
Deployments exposing the target search endpoint to Observer, Observer+, or Technician roles
Fleet tenants storing credentials such as AWS access keys or proxy passwords in team agent options

Discovery Timeline

2026-08-26 - CVE-2026-48786 published to the National Vulnerability Database
2026-08-26 - Last updated in the NVD database

Technical Details for CVE-2026-48786

Vulnerability Analysis

The vulnerability is an information exposure flaw ([CWE-200]) in Fleet's target picker API. When a user performs a target search, the server builds a response containing candidate teams so the caller can choose enrollment targets. The response object included the full team struct, embedding Secrets (enroll secrets) and Config.AgentOptions (agent configuration, which can carry credentials).

Elsewhere in Fleet, team-facing endpoints strip these sensitive fields for users with observer-class roles. The target search handler bypassed that sanitization. As a result, any authenticated user who could run an observer-runnable query, whether scoped globally or to a single team, could read the raw secrets from the API response.

Because Fleet allows administrators to embed credentials in agent options for osquery integrations, disclosed values can extend beyond enrollment tokens to cloud provider keys or HTTP proxy passwords.

Root Cause

The root cause is missing field-level authorization in the target search response builder in server/service/targets.go. The handler assembled the teams slice from the datastore without redacting Secrets or Config.AgentOptions before returning it to callers whose role should not see those fields.

Attack Vector

The attack requires network access to the Fleet API and valid credentials for an Observer, Observer+, or Technician account. The attacker issues a POST /api/latest/fleet/targets request referencing an observer-runnable query and parses results.Teams in the JSON response to extract enroll secrets and agent options. With a valid enroll secret, the attacker can enroll unauthorized hosts into the target team, extending their foothold and telemetry access.

// Security patch in server/service/targets.go
// POST /api/latest/fleet/targets returns more info than needed (#46082)
	if err != nil {
		return nil, err
	}

	// Strip unnecessary info from target search results.
	// The target picker only needs team ID, name, and host count.
	for _, t := range teams {
		t.Secrets = nil
		t.Config.AgentOptions = nil
	}

	results.Teams = teams

	return results, nil

Source: Fleet commit 6a48147. The patch nils out Secrets and Config.AgentOptions on each team before returning the target search response.

Detection Methods for CVE-2026-48786

Indicators of Compromise

Unexpected POST /api/latest/fleet/targets requests originating from accounts assigned Observer, Observer+, or Technician roles.
Enrollment of new hosts using team enroll secrets by IP ranges or hostnames not associated with sanctioned provisioning workflows.
API response payloads to /api/latest/fleet/targets in server logs containing secrets or agent_options fields prior to upgrading to 4.87.0.

Detection Strategies

Review Fleet audit and access logs for target search calls issued by non-admin roles, correlating request time with subsequent host enrollment events.
Inspect Fleet database or Git-managed team configurations for enroll secrets that should be rotated, and flag any secrets that appeared in outbound API traffic captures.
Alert on newly enrolled hosts that do not match expected hardware inventories or naming conventions for the team.

Monitoring Recommendations

Enable and centrally forward Fleet activity logs, then create rules for target search requests made by observer-class principals.
Monitor for use of AWS keys or proxy credentials referenced in agent options against CloudTrail or proxy authentication logs to catch abuse of disclosed credentials.
Track version metadata across Fleet servers to confirm all instances run 4.87.0 or later.

How to Mitigate CVE-2026-48786

Immediate Actions Required

Upgrade all Fleet servers to version 4.87.0 or later, which strips Secrets and Config.AgentOptions from target search responses.
Rotate every team enroll secret that existed while a vulnerable Fleet version was running, and re-enroll legitimate hosts using the new values.
Rotate any credentials, such as AWS secret access keys or proxy passwords, that were stored in team agent options during the exposure window.
Audit host inventories for unauthorized enrollments and remove any that cannot be attributed to sanctioned provisioning.

Patch Information

The fix is included in Fleet release fleet-v4.87.0 and implemented in commit 6a48147. Full details are published in GitHub Security Advisory GHSA-88p2-jj8w-j8qg.

Workarounds

Restrict Observer, Observer+, and Technician role assignments until the upgrade is complete, granting only accounts that strictly require them.
Remove credentials from team agent options where feasible, using a secrets manager or environment-scoped configuration instead.
Limit network reachability of the Fleet API to trusted management networks and enforce short session lifetimes for low-privilege users.

bash

# Verify Fleet server version after upgrade
fleetctl version

# Rotate a team enroll secret via fleetctl (example)
fleetctl apply -f team-config.yaml  # containing a newly generated enroll_secret value