Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint
Date: 2026-06
Affected: go/github.com/fleetdm/fleet/v4
Attack vector: deepfake
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-46370
CWE: CWE-200
CWE-89
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

### Summary A vulnerability in Fleet's labels host-listing endpoint allowed authenticated users with the lowest-privilege Observer role to extract host enrollment secrets (`node_key`, `orbit_node_key`) through a cursor-based binary search oracle. The endpoint accepted a user-supplied `order_key` parameter that was not validated against a column allowlist, permitting sort order to be driven by sensitive columns in a joined table. ### Impact The `GET /api/v1/fleet/labels/{id}/hosts` endpoint constructs its query using a deprecated helper that did not restrict which columns could appear in the `ORDER BY` clause. An attacker with Global Observer or Team Observer credentials could supply a sensitive column name (for example, `h.node_key`) as `order_key` and combine it with the cursor-based `after` parameter to binary-search the values of those columns one character at a time. The targeted values never appeared in the response body, but the presence or absence of results revealed each character. The `node_key` and `orbit_node_key` values are the long-lived shared secrets used by osquery and Orbit agents to authenticate to the Fleet server. An attacker who extracted these keys could: - Impersonate enrolled hosts to Fleet's osquery and Orbit endpoints - Submit fabricated query results and host inventory data - Retrieve pending scripts and MDM commands queued for the host - Poison compliance and policy results across the Fleet deployment Exploitation required authenticated Obser


Mitigations:

Architectural layers (MAESTRO):