fleetdm Fleet up to 4.84.1 Labels Host-Listing Endpoint hosts order_key/after information disclosure

Summaryinfo

A vulnerability identified as problematic has been detected in fleetdm Fleet up to 4.84.1. This impacts an unknown function of the file /api/v1/fleet/labels/{id}/hosts of the component Labels Host-Listing Endpoint. Performing a manipulation of the argument order_key/after results in information disclosure. This vulnerability was named CVE-2026-46370. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in fleetdm Fleet up to 4.84.1. It has been classified as problematic. This affects some unknown functionality of the file /api/v1/fleet/labels/{id}/hosts of the component Labels Host-Listing Endpoint. The manipulation of the argument order_key/after with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. The summary by CVE is:

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoint (GET /api/v1/fleet/labels/{id}/hosts) allowed an authenticated user with the lowest-privilege Observer role to extract host enrollment secrets through a sort-order oracle. The endpoint accepted a user-supplied order_key parameter that was not validated against a column allowlist, so an attacker with Global or Team Observer access could set the sort column to a sensitive field such as h.node_key and combine it with the cursor-based after parameter to binary-search the value one character at a time; the targeted value never appeared in the response, but the presence or absence of results revealed each character. Because node_key and orbit_node_key are the long-lived shared secrets that osquery and Orbit agents use to authenticate to the Fleet server, an attacker who reconstructed them could impersonate enrolled hosts, submit fabricated query results and inventory, retrieve pending scripts and MDM commands, and poison compliance and policy results across the deployment. This issue is fixed in version 4.84.2.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-46370 since 05/13/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading to version 4.84.2 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• fleetdm

Name

• Fleet

Version

• 4.84.0
• 4.84.1

Website

• Product: https://github.com/fleetdm/fleet/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion