CVE-2026-46371 in Fleet
Summary
by MITRE • 08/26/2026
Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the Apple MDM commands listing endpoint (GET /api/v1/fleet/mdm/apple/commands) allowed an authenticated user with the lowest-privilege Observer role to extract sensitive values from joined database tables, including host enrollment secrets and Apple Push Notification Service tokens, through a sort-order oracle. The endpoint accepted a user-supplied order_key parameter that was not validated against a column allowlist, and because the underlying query joins the hosts and nano_enrollments tables, an attacker could set the sort column to a sensitive field and combine it with the cursor-based after parameter to binary-search the value one character at a time, with the presence or absence of results revealing each character even though the value never appeared in the response. With extracted node_key or orbit_node_key values an attacker could impersonate enrolled hosts to Fleet's osquery and Orbit endpoints, submit fabricated host data, and retrieve pending scripts and commands. This issue is fixed in version 4.84.2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as CVE-2023-6579 represents a critical information disclosure flaw within the Fleet device management platform, specifically affecting versions up to and including 4.84.1. This open-source tool, which leverages osquery for endpoint detection and response capabilities, suffered from an insecure direct object reference combined with a blind binary search mechanism in its Apple MDM commands listing endpoint. The core technical flaw resides in the GET /api/v1/fleet/mdm/apple/commands API route, where the application failed to implement proper input validation on the order_key parameter used for sorting query results. Instead of restricting this parameter to a predefined allowlist of safe column names, the backend database engine accepted arbitrary field identifiers provided by the user. This lack of sanitization allowed an authenticated attacker operating with the lowest-privilege Observer role to manipulate the underlying SQL query structure in ways that exposed sensitive data from joined tables, specifically the hosts and nano_enrollments tables which contain host enrollment secrets and Apple Push Notification Service tokens respectively.
The operational exploitation of this vulnerability relies on a sophisticated side-channel attack technique known as an order-based oracle or blind binary search. Because the API response indicates whether results are returned based on the sorting criteria without explicitly displaying the sorted values, an attacker can deduce sensitive information character by character. By setting the sort column to a target field containing secret data and adjusting the cursor-based after parameter, the attacker forces the database to order records such that the presence or absence of specific rows reveals whether the guessed character matches the actual value at a given position. This process allows for the systematic extraction of high-value credentials like node_key or orbit_node_key values without ever seeing them directly in the HTTP response payload. The precision of this technique means that even complex, long secret strings can be reconstructed with minimal interaction overhead, effectively bypassing standard access controls designed to prevent low-privilege users from viewing sensitive configuration data.
The impact of successfully extracting these credentials is severe and extends beyond mere information disclosure into active system compromise. With the ability to impersonate enrolled hosts using stolen node_key or orbit_node_key values, an attacker gains unauthorized access to Fleet's osquery and Orbit endpoints. This capability allows the adversary to submit fabricated host telemetry data, potentially poisoning security analytics with false positives or masking malicious activity through noise injection. Furthermore, the attacker can retrieve pending scripts and commands intended for managed devices, which may contain sensitive operational logic or credentials embedded within them. The compromise of Apple Push Notification Service tokens further exacerbates the risk by enabling potential interception or manipulation of push notifications used for real-time device management and alerting, thereby undermining the integrity of the entire mobile device management infrastructure.
From a classification perspective, this vulnerability aligns with CWE-209, which describes an information exposure through an error message that reveals sensitive details to unauthorized actors, although in this case the exposure is achieved via logical manipulation rather than explicit error dumping. It also maps closely to CWE-613, insufficient session expiration, as it involves the misuse of valid authentication tokens and keys. In terms of offensive security frameworks, the exploitation technique corresponds to ATT&CK T1078, Valid Accounts, specifically the sub-technique of using legitimate credentials for unauthorized access, and potentially T1592, Gather Victim Host Information, through the enumeration of sensitive configuration data via API manipulation. The attack vector is classified as Network-based with Low complexity but requires Authentication, highlighting that while no network-level exploit was needed, the logical flaw in input validation allowed privilege escalation from a low-privilege role to full host impersonation capabilities.
Mitigation for this vulnerability involves immediate upgrading of the Fleet platform to version 4.84.2 or later, where the developers have implemented strict allowlisting for API parameters and enhanced input sanitization routines. Organizations should also audit their current deployment configurations to ensure that no legacy instances remain unpatched in production environments. Beyond patching, security teams should enforce principle of least privilege by reviewing role-based access control policies, ensuring that Observer roles do not possess permissions on endpoints that interact with sensitive database joins unless absolutely necessary for operational requirements. Implementing Web Application Firewall rules that detect abnormal sorting patterns or unusual API parameter structures can provide an additional layer of defense against similar order-based oracle attacks in other applications within the enterprise ecosystem.