PT-2026-49057 · Go · Github.Com/Fleetdm/Fleet/V4

Published

2026-06-12

·

Updated

2026-06-12

·

CVE-2026-46371

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

A vulnerability in Fleet's Apple MDM commands listing endpoint allowed authenticated users with the lowest-privilege Observer role to extract sensitive values from joined database tables — including host enrollment secrets and Apple Push Notification Service (APNS) tokens — through a cursor-based binary search oracle. The endpoint accepted a user-supplied order key parameter that was not validated against a column allowlist.

Impact

The GET /api/v1/fleet/mdm/apple/commands endpoint constructs its query using a deprecated helper that did not restrict which columns could appear in the ORDER BY clause. The underlying query joins the hosts and nano enrollments tables, so any column on those tables could be supplied as order key. An attacker with Observer credentials could then use the cursor-based pagination parameter (after) to binary-search the value of the chosen column one character at a time. The targeted values never appeared in the response body, but the presence or absence of results revealed each character.
With extracted node key or orbit node key values, an attacker could impersonate enrolled hosts to Fleet's osquery and Orbit endpoints, submit fabricated host data, and retrieve pending scripts and commands. The APNS values are exploitable only by a party that also possesses the organization's APNS certificate.
Exploitation required authenticated Observer access and a Fleet deployment with Apple MDM enabled and at least one queued MDM command. Instances without Apple MDM configured were not affected.

Workarounds

If an immediate upgrade is not possible, administrators should:
  • Restrict the Observer role to fully trusted users until the patch is applied
  • Rotate node key and orbit node key for any host suspected of exposure by re-enrolling the affected hosts

For more information

If there are any questions or comments about this advisory:
Email Fleet at security@fleetdm.com Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)

Credits

Fleet thanks the Security Team at Palantir Technologies for responsibly reporting this issue.

Fix

Information Disclosure

SQL injection

Weakness Enumeration

CWE-200CWE-89

Related Identifiers

CVE-2026-46371
GHSA-X4QR-QW6H-WVXQ

Affected Products

Github.Com/Fleetdm/Fleet/V4