CVE-2026-46371

Executive Summary

CVE-2026-46371 is a high-severity information disclosure vulnerability in the Fleet open-source device management platform, affecting versions up to and including 4.84.1. The flaw resides in the Apple MDM commands listing endpoint at GET /api/v1/fleet/mdm/apple/commands, where an authenticated user with only the lowest-privilege Observer role can extract sensitive values — including host enrollment secrets and Apple Push Notification Service (APNs) tokens — from joined database tables via an unvalidated sort-order parameter. Exploitation enables an attacker to impersonate enrolled hosts, submit fabricated telemetry data, and retrieve pending scripts and commands; the issue is remediated in version 4.84.2.

Technical Analysis

The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command — "SQL Injection"), although the NVD description indicates a more specific blind-side-channel mechanism rather than classic direct SQL injection.

Affected Endpoint and Parameter. The vulnerable functionality is the Apple MDM commands listing API endpoint located at GET /api/v1/fleet/mdm/apple/commands. This endpoint accepts a user-supplied order_key parameter that is intended to control the sort column of the returned command listing. The NVD description explicitly states that this parameter is not validated against a column allowlist, meaning an authenticated client can supply arbitrary column names to be used in the underlying SQL ORDER BY clause.

Database Schema and Join. The underlying database query performs a JOIN between the hosts table and the nano_enrollments table. The hosts table contains device enrollment metadata, while nano_enrollments contains Apple MDM enrollment records. Critically, these joined tables include sensitive fields such as:

• Host enrollment secrets (including node_key and orbit_node_key values used for osquery and Orbit authentication)
• Apple Push Notification Service (APNs) tokens

Because the order_key parameter is reflected directly into the ORDER BY clause without allowlist validation, a crafted request can sort the result set by any column in the joined schema — including columns that are not part of the intended result projection.

The Sort-Order Oracle Technique. The exploitation mechanism is a blind, character-level extraction technique that leverages the combination of the order_key and after parameters:

1. The attacker sets order_key to a sensitive column (e.g., a column holding enrollment secrets or APNs tokens).
2. The attacker uses the cursor-based pagination parameter after to position the query cursor at a specific offset.
3. By submitting carefully crafted sort-order comparisons (ordering ascending vs. descending) combined with cursor positions, the attacker can determine whether a given character at a specific byte position is lexicographically greater than, less than, or equal to a guessed value.
4. The presence or absence of results in the response reveals the result of each comparison — a classic binary search oracle — allowing the attacker to reconstruct the full value of a sensitive column one character at a time, even though the raw value never appears in the HTTP response body.

Data Exfiltrated. The oracle permits extraction of node_key or orbit_node_key values, which serve as authentication credentials for Fleet's osquery and Orbit endpoints. Additionally, host enrollment secrets and APNs tokens are accessible, though the description emphasizes the node keys for downstream impersonation.

Impact on Integrity and Confidentiality. The CVSS vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N — a network-exploitable, low-complexity attack requiring only low-privilege authentication, with a High confidentiality impact and no direct integrity or availability impact. However, the description notes that extracted credentials enable impersonation of enrolled hosts, which extends the practical impact beyond read-only disclosure to unauthorized device spoofing, submission of fabricated host data, and retrieval of pending scripts/commands intended for legitimate devices.

Exploitation Scenarios

Preconditions:

• The attacker must have a valid account on a Fleet deployment with the Observer role — explicitly stated as the lowest privilege level.
• The Fleet server must be network-accessible.
• The target deployment must be running Fleet version 4.84.1 or earlier.

Step 1 — Reconnaissance and Target Identification.

• An attacker with Observer credentials enumerates the API surface. The endpoint GET /api/v1/fleet/mdm/apple/commands is accessible to the authenticated user.
• The attacker inspects API responses and documentation to determine the accepted query parameters (order_key, after) and confirms the response format.

Step 2 — Triggering the Vulnerability Class.

• The attacker submits a legitimate request to the endpoint with order_key=created_at (or a benign column) to confirm the endpoint functions and to understand pagination semantics.
• The attacker then submits a request with order_key set to a sensitive column name (e.g., a column in the joined hosts table holding enrollment secrets). Because the parameter is not allowlist-validated, the SQL query executes with the attacker-controlled sort column.
• The attack is a blind SQL injection via ORDER BY clause — no direct SQL metacharacters are injected into a WHERE clause; instead, the sort column itself becomes the exfiltration channel.

Step 3 — Character-Level Extraction via Sort-Order Oracle.

• The attacker pairs the order_key parameter with the after pagination cursor.
• For a target column value (e.g., a node_key), the attacker positions the cursor at offset N (targeting the Nth character of the value).
• The attacker issues two requests per guess: one sorting ascending and one sorting descending. By observing whether the result set contains 0 records or >0 records (and the order of returned record IDs), the attacker determines the lexicographic relationship of the target character to the guessed character.
• This yields one bit of information per request pair, enabling a binary search over the character space (e.g., 7 guesses per ASCII character). A 64-character node_key requires approximately 448 request pairs.
• The extraction is fully remote and requires no client-side rendering — responses only need to indicate record presence/absence.

Step 4 — Post-Exploitation: Host Impersonation.

• Once the attacker extracts a node_key or orbit_node_key for a valid enrolled host, they can:
  • Impersonate the host to Fleet's osquery and Orbit endpoints (authenticate as that device).
  • Submit fabricated host data (invented process listings, network sockets, file hashes) — corrupting fleet-wide visibility and potentially triggering false security alerts or masking real compromise.
  • Retrieve pending scripts and commands destined for the legitimate host, disclosing operational instructions that may reveal internal naming conventions, security policies, or scheduled remediation actions.

Note on PoC Availability: No public proof-of-concept, exploit code, or Nuclei template is available at the time of writing. The attack chain above is inferred strictly from the NVD description's mechanism (sort-order oracle, order_key unvalidated, after cursor combination). Specific column names in the hosts and nano_enrollments tables beyond those explicitly named (node_key, orbit_node_key) are not enumerated in the description and should not be assumed.

Impact Assessment

CVSS Analysis:

• Attack Vector: Network (AV:N) — the endpoint is remotely reachable over the HTTP API.
• Attack Complexity: Low (AC:L) — the attack requires only repeated benign HTTP requests; no special network conditions or race conditions.
• Privileges Required: Low (PR:L) — the Observer role is the default/least-privileged role, widely granted for visibility.
• User Interaction: None (UI:N).
• Scope: Unchanged (S:U).
• Confidentiality: High (C:H) — full extraction of enrollment secrets and APNs tokens.
• Integrity: None (I:N) — per the official vector; however, the extracted credentials enable downstream host impersonation, which is a secondary integrity concern.
• Availability: None (A:N).

Business Impact:

• Credential Exposure: Enrollment secrets and APNs tokens are long-lived credentials. Leaked APNs tokens could enable push-notification channel abuse against enrolled Apple devices.
• Device Impersonation / Trust Compromise: Fleet's device management trust model is broken if attackers can register fake telemetry. Security teams relying on osquery data for incident detection would receive attacker-controlled data.
• Operational Disclosure: Pending scripts and commands retrieved via impersonation reveal internal automation logic, potential patch cycles, or security tooling configurations.
• Compliance: For enterprise fleets managing regulated devices (healthcare, finance), unauthorized extraction of sensitive device metadata may trigger breach-notification obligations.

Blast Radius: All Fleet-managed devices in the affected deployment are at risk of impersonation. The vulnerability is exploitable by any authenticated user with the Observer role — this typically includes contractors, third-party support staff, and internal auditors, greatly widening the trusted-attacker surface.

Detection Guidance

The following detection artifacts focus on the observable HTTP traffic patterns and server-side anomalies associated with the sort-order oracle technique.

Sigma Rule

title: Fleet MDM Commands Endpoint - Suspicious order_key Parameter Usage
id: 4f8a3c2e-9b1d-4e5f-a6c7-8d9e0f1a2b3c
status: experimental
description: >
  Detects repeated requests to Fleet's Apple MDM commands listing endpoint
  with a high volume of distinct order_key values or order_key values that
  reference sensitive columns, indicating possible blind sort-order oracle exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-46371
author: Valtersit Threat Intelligence
date: 2026/01/15
logsource:
  category: webserver
  product: nginx
  service: http
detection:
  selection:
    http.url.path:
      - '/api/v1/fleet/mdm/apple/commands'
  filter_benign:
    http.url.query|contains: 'order_key=created_at'
  condition: selection and not filter_benign
  timeframe: 5m
  aggregation:
    - field: client.ip
      function: count
      condition: '> 25'
level: high
falsepositives:
  - Legitimate API clients that sort by non-created_at columns for UI reasons
  - Internal automation performing pagination with custom sort keys
tags:
  - attack.t1213
  - cve.2026-46371
  - cwe.89

YARA Rule

rule CVE_2026_46371_Fleet_MDM_OrderKey_Oracle
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects log lines or payload captures with suspicious order_key values targeting Fleet MDM endpoints"
        cve = "CVE-2026-46371"
        date = "2026-01-15"
        severity = "high"
    strings:
        $mdm_path = "/api/v1/fleet/mdm/apple/commands" ascii wide nocase
        $order_key_param = "order_key=" ascii wide nocase
        $after_param = "after=" ascii wide nocase
        $sensitive_col_hint = "node_key" ascii wide nocase
        $sensitive_col_hint2 = "orbit_node_key" ascii wide nocase
        $sensitive_col_hint3 = "push_notification_topic" ascii wide nocase
        $sensitive_col_hint4 = "enroll_secret" ascii wide nocase
        $sensitive_col_hint5 = "token" ascii wide nocase
    condition:
        all of ($mdm_path, $order_key_param, $after_param) and
        1 of ($sensitive_col_hint*)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2026-46371 Fleet MDM Sort-Order Oracle Attempt";
    flow:established,to_server;
    http.uri;
    content:"/api/v1/fleet/mdm/apple/commands";
    http.uri;
    content:"order_key=";
    http.uri;
    pcre:"/order_key=(?!created_at|id|updated_at)[a-zA-Z_]+/";
    http.uri;
    pcre:"/after=\d{1,}/";
    threshold:type=both, track=by_src, count=20, seconds=60;
    reference:cve,2026-46371;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-46371;
    classtype:attempted-recon;
    sid:9000046371;
    rev:1;
    metadata:created_at 2026-01-15;
)

Elastic Detection

sequence by source.ip
  with maxspan=5m
  [network where
    network.protocol == "http" and
    http.request.method == "GET" and
    url.path == "/api/v1/fleet/mdm/apple/commands" and
    url.query : "*order_key=*" and
    not url.query : "*order_key=created_at*"
  ] with runs=25

Splunk SPL Query

index=proxy OR index=web
  uri_path="/api/v1/fleet/mdm/apple/commands"
  uri_query="*order_key=*"
  NOT uri_query="*order_key=created_at*"
| eval suspicious = if(match(uri_query, "(?i)(node_key|orbit_node_key|enroll_secret|token|push_notification)"), 1, 0)
| stats count by src_ip, uri_query, suspicious, _time
| where count > 15 OR suspicious == 1
| sort - count

Wazuh OSSEC Rule

<group name="fleet_cve_2026_46371,">
  <rule id="100937" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">/api/v1/fleet/mdm/apple/commands</field>
    <regex>order_key=</regex>
    <regex>(node_key|orbit_node_key|enroll_secret|token)</regex>
    <description>Fleet MDM order_key oracle — CVE-2026-46371 suspicious sort parameter</description>
    <group>fleet,mdm,cve_2026_46371,pci_dss_6.5.1,</group>
    <mitre>
      <id>T1213</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence Assessment: 0/4 — UNPATCHED.

⚠ Important: The NVD description states this issue is "fixed in version 4.84.2," yet the patch-confidence metadata in the provided CVE intelligence data indicates 0/4 patch evidence from tracked sources, with no vendor advisory URL available. This discrepancy must be resolved. If 4.84.2 exists and is from the official vendor, upgrade immediately. If not yet available, treat as actively exploitable.

1. Immediate Mitigations (do these today):

• Upgrade Fleet to version 4.84.2 or later if the release is available from the official vendor repository. This is the only definitive fix.
• Restrict Observer role access to this API endpoint if the Fleet version does not support endpoint-level RBAC, apply a reverse-proxy ACL rule blocking GET /api/v1/fleet/mdm/apple/commands for non-admin roles.
• Audit observer-role accounts — identify all accounts with Observer privilege and review their recent API access logs for anomalous order_key values or high request volumes to /api/v1/fleet/mdm/apple/commands.
• Rotate all enrollment secrets (node_key, orbit_node_key) and APNs tokens if there is any suspicion of prior exploitation, as these are long-lived credentials that cannot be invalidated by a software fix alone.
• Apply WAF rules to block order_key values that do not match a strict allowlist (e.g., only created_at, id).

2. Patch / Upgrade Steps:

1. Verify the current version: fleet --version or check the deployed container tag.
2. If version ≤ 4.84.1, obtain the 4.84.2 release from the official Fleet GitHub repository / Docker Hub (fleetdm/fleet image tag v4.84.2).
3. Back up the Fleet MySQL database and the configuration files.
4. Follow the standard upgrade procedure: fleet prepare db and then replace the binary/image.
5. Post-upgrade, restart the Fleet server and verify the endpoint no longer reflects arbitrary order_key values (test with a deliberately invalid column name — it should be rejected).

3. Long-Term Hardening:

• Column Allowlist Enforcement (code-level): ensure all user-controllable sort parameters are validated against a strict server-side allowlist of columns that are safe to expose for ordering, with no string concatenation into ORDER BY.
• Prepared Statements / Query Builder: refactor the vulnerable query to use a parameterized query builder that never interpolates user input into SQL identifiers.
• Developer Security Training: review Fleet's API parameter handling patterns to identify other endpoints with similar unvalidated sort/filter parameters.
• Network Segmentation: ensure the Fleet management API is only reachable from trusted network segments and VPNs; consider requiring mTLS for all management-plane access.
• Least-Privilege Review: assess whether Observer role accounts genuinely need API access to MDM command endpoints, or whether a read-only dashboard suffices.
• Monitoring: retain the Sigma/Elastic/Splunk detection rules from this report in production monitoring to catch regressions or new variants.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-46371
2. Fleet Documentation (version-specific upgrade guidance): https://fleetdm.com/docs/deploy/upgrade
3. Fleet GitHub Repository (release tags / fix verification): https://github.com/fleetdm/fleet/releases
4. MITRE ATT&CK Technique T1213 — Data from Information Repositories: https://attack.mitre.org/techniques/T1213/
5. CWE-89 — SQL Injection: https://cwe.mitre.org/data/definitions/89.html

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: None reported at the time of writing. CISA KEV status: NO — this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. No public PoC, exploit code, or Nuclei template exists. However, the low complexity of the attack and the low privilege requirement make in-the-wild exploitation likely once 4.84.2 becomes widely deployed, as unpatched 4.84.1 instances will be identifiable through Shodan searches for the Fleet web interface.