CVE-2026-46370

Executive Summary

CVE-2026-46370 is a high-severity information disclosure vulnerability in Fleet, an open-source device management platform built on osquery. Affecting versions up to and including 4.84.1, the flaw resides in the labels host-listing endpoint GET /api/v1/fleet/labels/{id}/hosts, where an unvalidated order_key parameter enables an authenticated low-privileged user (Observer role) to perform a sort-order oracle attack and reconstruct sensitive host enrollment secrets (node_key and orbit_node_key). Successful exploitation allows an attacker to impersonate enrolled hosts, submit fabricated telemetry, retrieve pending scripts and MDM commands, and poison compliance/policy data across the entire deployment. The issue is patched in version 4.84.2. No public PoC or in-the-wild exploitation has been reported; CVSS base score is 6.5 (Medium-High) driven by complete confidentiality loss with low attack complexity.

Technical Analysis

Vulnerability Class (CWE-89 — SQL Injection): Although catalogued under CWE-89 (SQL Injection), the practical mechanism described in the NVD entry is a sort-order oracle enabled by improper input validation of a parameter used in a database query's ORDER BY clause. The endpoint GET /api/v1/fleet/labels/{id}/hosts accepts a user-controlled order_key parameter that is concatenated into the sort column of a SQL query without being checked against a column allowlist.

Mechanism: In Fleet's host-listing endpoint, the order_key parameter nominally supports benign sort columns (e.g., id, hostname, created_at). Because the parameter is injected directly into the ORDER BY portion of the SQL statement, an attacker can supply any column name present in the underlying hosts table — including sensitive columns like node_key (the osquery agent's shared authentication secret) and orbit_node_key (used by the Orbit management agent). The endpoint also supports cursor-based pagination via the after parameter, which encodes the value of the sort column at the last returned row.

Attack Primitive: The attacker exploits the combination of:

1. Arbitrary sort column (e.g., order_key=h.node_key).
2. Cursor-based pagination (after parameter) that encodes a partial guess of the secret.

By setting the cursor to a guess like a, the endpoint returns rows whose node_key is lexicographically greater than a — or returns zero results if the guess is too high. This binary decision (result set present or empty) reveals one character of the secret at a time. Repeating this process character-by-character (and byte-by-byte) reconstructs the full secret. The secret itself never appears in the HTTP response, defeating naive monitoring that looks for secret values in response bodies.

Attack Surface: The endpoint is accessible to any authenticated user with Global or Team Observer role — the lowest-privilege role in Fleet designed for read-only visibility. This means the vulnerability can be triggered by legitimate low-trust accounts (e.g., a monitoring contractor, a read-only auditor), significantly widening the practical attack surface. The attack is fully remote, requires no special network position, and only requires low-privilege credentials.

Impact on Trust Model: node_key is the long-lived secret that osquery agents present to the Fleet server to authenticate and associate with a specific host. orbit_node_key serves the same role for the Orbit agent management component. These secrets are the cornerstone of the Fleet authentication trust model; their disclosure breaks host identity verification entirely.

Exploitation Scenarios

Step 1 — Reconnaissance / Target Identification: The attacker authenticates to a Fleet instance (version ≤ 4.84.1) using credentials for a low-privilege Observer role (Global or Team Observer). They enumerate available label IDs by querying the labels list endpoint, selecting any label containing hosts (e.g., label/{id}/hosts).

Step 2 — Flaw Trigger: The attacker crafts an HTTP request to GET /api/v1/fleet/labels/{id}/hosts?order_key=h.node_key&after=<guess>.

Step 3 — Payload / Execution (vulnerability-class level): The attacker performs a binary search over the character set. For each position in the secret:

• Set the after cursor to a guessed prefix (e.g., a, then aa, ab, ...).
• Observe whether the response returns zero hosts or a non-empty host list.
• If non-empty, the guessed prefix is lexicographically less than the actual secret; if empty, the guess is greater or equal — narrowing down the exact byte value.

This process repeats character-by-character until the entire node_key or orbit_node_key for a target host is reconstructed. Complexity is O(n × log(charset)) requests per secret, where n is the secret length (typically 32–64 hex characters). For a 40-character key, this is roughly 200–300 HTTP requests — trivially scriptable.

Step 4 — Post-Exploitation Impact: With the reconstructed node_key, the attacker can:

• Impersonate the enrolled host by presenting the stolen secret to the Fleet server.
• Submit fabricated osquery results, inventory data, and host details.
• Retrieve pending scripts and MDM commands meant for the legitimate host.
• Poison compliance, policy, and vulnerability data across the deployment, potentially triggering false remediation actions or masking real security issues.

Note: No public PoC or exploit code has been released. The attack chain above is inferred from the vulnerability mechanism described in the NVD entry and the known design of Fleet's query-parameter handling. It is not derived from observed exploit code.

Impact Assessment

Confidentiality (High): The vulnerability directly exposes the two most security-critical secrets in the Fleet platform — node_key and orbit_node_key — for any or all enrolled hosts. These secrets are the equivalent of SSH private keys for fleet agents; their disclosure is a full compromise of the host-authentication trust layer.

Integrity (High, indirect): Although CVSS lists integrity impact as None for the direct oracle attack (the attacker only reads information), the disclosed secrets enable subsequent integrity violations — an attacker can submit fabricated query results, falsify inventory, and manipulate compliance/remediation decisions. The indirect integrity impact is severe.

Availability (None direct): The oracle attack itself does not cause denial of service, though an attacker could inject malformed results that trigger instability in downstream processing.

Affected Systems: All Fleet deployments running 4.84.1 or earlier, including on-premises installations, self-hosted Kubernetes deployments, and managed instances provisioned by the vendor. The attacker requires only a valid Observer role account; organizations granting such roles to external auditors, contractors, or semi-trusted users are at highest risk.

Blast Radius: Full compromise of the device management trust plane — every enrolled host's credentials are potentially extractable. Subsequent impersonation attacks could affect 100% of managed endpoints.

Detection Guidance

Sigma Rule

title: Suspicious Sort Order Oracle against Fleet Labels Host Endpoint
id: 3f6a9c2e-8b1d-4e77-9b3a-2f3a8e4c1d5a
status: experimental
description: Detects repeated requests to Fleet labels host endpoint with unusual order_key values targeting sensitive columns, indicative of sort-order oracle attacks.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-46370
tags:
    - attack.t1213
    - cve.2026-46370
logsource:
    category: webserver
    detection:
        selection:
            http.url_path|startswith: /api/v1/fleet/labels/
            http.url_path|endswith: /hosts
            http.url_query|contains|all:
                - 'order_key='
                - 'after='
        sensitive_order_keys:
            http.url_query|contains|any:
                - 'order_key=h.node_key'
                - 'order_key=node_key'
                - 'order_key=orbit_node_key'
                - 'order_key=h.orbit_node_key'
        filter_benign:
            http.url_query|contains|any:
                - 'order_key=hostname'
                - 'order_key=id'
                - 'order_key=created_at'
                - 'order_key=updated_at'
        condition: selection and sensitive_order_keys and not filter_benign
    level: high
    falsepositives:
        - Legitimate debugging by Fleet administrators (rare, should be investigated)
        - Fleet internal tools using undocumented order_key values
fields:
    - client.ip
    - user.name
    - http.url
    - http.response.status_code
    - event.duration
    - rule.type
timeline:
    - '2026-01-15: Initial rule creation'

YARA Rule

rule CVE_2026_46370_Fleet_SortOracle_SuspiciousRequests {
    meta:
        author = "ValtersIT Threat Intelligence"
        date = "2026-01-15"
        description = "Detects HTTP requests targeting Fleet labels host endpoint with order_key parameter set to sensitive columns (node_key, orbit_node_key), indicating attempted sort-order oracle attack."
        cve = "CVE-2026-46370"
        severity = "high"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-46370"
    strings:
        $endpoint = "/api/v1/fleet/labels/" ascii wide nocase
        $hosts_suffix = "/hosts" ascii wide nocase
        $order_key = "order_key=" ascii wide nocase
        $node_key = "node_key" ascii wide nocase
        $orbit_key = "orbit_node_key" ascii wide nocase
        $after_param = "after=" ascii wide nocase
    condition:
        uint16(0) == 0x0D0A? and
        filesize < 10KB and
        $endpoint and $hosts_suffix and $order_key and $after_param and
        ($node_key or $orbit_key)
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2026-46370 Fleet sort-order oracle attempt - sensitive order_key in labels host endpoint";
    flow:to_server;
    http.uri; content:"/api/v1/fleet/labels/"; http.uri; content:"/hosts"; http.uri;
    http.uri; content:"order_key="; http.uri; content:"node_key"; http.uri;
    http.uri; content:"after=";
    http.method; content:"GET";
    classtype:attempted-recon;
    reference:cve,2026-46370;
    sid:2026015001;
    rev:1;
)

alert http any any -> any any (
    msg:"CVE-2026-46370 Fleet sort-order oracle - orbit_node_key sort attempt";
    flow:to_server;
    http.uri; content:"/api/v1/fleet/labels/"; http.uri; content:"/hosts"; http.uri;
    http.uri; content:"order_key="; http.uri; content:"orbit_node_key"; http.uri;
    http.uri; content:"after=";
    http.method; content:"GET";
    classtype:attempted-recon;
    reference:cve,2026-46370;
    sid:2026015002;
    rev:1;
)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [ any where
      event.dataset == "nginx.access" and
      url.path like "/api/v1/fleet/labels/*/hosts" and
      url.query contains "order_key=" and
      url.query contains "after=" and
      (url.query contains "node_key" or url.query contains "orbit_node_key")
  ] with runs=10

Splunk SPL Query

index=web* sourcetype=access_combined
| where like(uri_path, "%/api/v1/fleet/labels/%") 
  AND like(uri_path, "%/hosts%")
  AND like(uri_query, "%order_key=%")
  AND like(uri_query, "%after=%")
  AND (like(uri_query, "%node_key%") OR like(uri_query, "%orbit_node_key%"))
| stats count as request_count, values(uri_query) as queries, 
        earliest(_time) as first_seen, latest(_time) as last_seen
  by src_ip, user
| where request_count > 5
| eval summary = "Potential sort-order oracle scanning from " . src_ip
  . " user " . user . " with " . request_count . " suspicious requests"
| table _time, src_ip, user, request_count, first_seen, last_seen, queries, summary
| sort -request_count

Wazuh OSSEC Rule

<rule id="100463" level="12">
  <decoded>apache-accesslog</decoded>
  <field name="url" type="pcre2">/api/v1/fleet/labels/[0-9a-f-]+/hosts\?.*order_key=(node_key|orbit_node_key)</field>
  <description>CVE-2026-46370: Fleet sort-order oracle attempt using sensitive order_key in labels host endpoint</description>
  <group>fleet,cve-2026-46370,recon,</group>
  <mitre>
    <id>T1213</id>
  </mitre>
  <options>no_full_log</options>
  <if_sid>100000</if_sid>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED in tracked sources; patch exists in version 4.84.2 per NVD description, but no patch evidence from independent tracking sources at time of writing).

Immediate mitigations (until upgrade to 4.84.2):

1. Restrict Observer role access: Review all Observer accounts (Global and Team). If possible, revoke or downgrade Observer access to the Fleet API until the patch is applied. Consider removing external contractors/auditors from this role.
2. Network-level filtering: Deploy WAF rules that block order_key values containing node_key or orbit_node_key in requests to /api/v1/fleet/labels/*/hosts.
3. Rate limiting: Implement strict rate limiting on the labels host-listing endpoint to slow down the binary-search oracle (each character guess requires multiple requests; aggressive rate limits may prevent full key reconstruction within a practical timeframe).
4. Logging and alerting: Enable logging of all requests to the labels host endpoint, with a focus on capturing the order_key and after parameters. Activate alerts for any request containing sensitive column names.
5. Monitor for anomalies: Watch for credential reuse or unexpected agent behavior (new "reconnections" from known host IDs, unusual osquery results).

Patch/Upgrade Steps:

1. Immediately upgrade to Fleet 4.84.2 — the NVD description confirms this version fixes the vulnerability. This is the only definitive remediation.
2. After upgrade, rotate all node_key and orbit_node_key values for enrolled hosts. Even with the patch, previously extracted secrets may have been captured; rotation is mandatory to restore the trust boundary.
3. Verify patch integrity against the vendor's release notes before deployment to production.

Long-term Hardening:

1. Undertake a review of the Fleet API query-parameter handling to ensure all sort/filter/pagination parameters are validated against column allowlists — the vulnerability class (CWE-89, improper input validation) is broader than a single endpoint.
2. Implement regular secret rotation for node_key/orbit_node_key (e.g., quarterly) to bound the impact of future disclosures.
3. Enable Fleet's audit logging and integrate its API activity into SIEM for continuous monitoring.
4. Establish a process for regular security reviews of Fleet releases, including checking for CWE-89 patterns in query construction.

References

1. NVD Entry — CVE-2026-46370: https://nvd.nist.gov/vuln/detail/CVE-2026-46370
2. Fleet Device Management official site (vendor product): https://fleetdm.com/
3. Fleet Documentation — osquery device management overview: https://fleetdm.com/docs
4. MITRE ATT&CK — T1213 Data from Information Repositories: https://attack.mitre.org/techniques/T1213/
5. CWE-89 — Improper Neutralization of Special Elements used in an SQL Command: https://cwe.mitre.org/data/definitions/89.html

Threat Actor Activity: No known campaigns, exploits-in-the-wild, or threat actor references exist for CVE-2026-46370 at the time of writing. The vulnerability is classified as unpatched in tracked sources (0/4 patch confidence) despite the NVD description confirming a fix in 4.84.2 — this discrepancy should be monitored: if the vendor release is incomplete or misreported, affected deployments may remain exposed.

CISA KEV: Not listed (NO) — no known exploitation in the wild as of this report.