CVE-2026-48786

Executive Summary

CVE-2026-48786 is an information disclosure vulnerability in the Fleet open-source device management platform (built on osquery) affecting all versions prior to 4.87.0. The vulnerability allows an authenticated low-privilege user (Observer, Observer+, or Technician role — global or team-scoped) to retrieve unmasked team enroll secrets and full team configurations, including credential-bearing agent options, via the target search endpoint (POST /api/latest/fleet/targets). A successful exploit discloses highly sensitive data — enroll secrets that permit unauthorized host enrollment, and cloud credentials (e.g., AWS secret access keys) or proxy passwords embedded in agent options — with a CVSS base score of 6.5 (High confidentiality impact, low attack complexity, low privileges required, no user interaction).

Technical Analysis

Vulnerability Mechanism. Fleet enforces role-based access control (RBAC) across its API surface. Sensitive fields — team enroll secrets and agent options containing credentials — are meant to be masked (redacted) when returned to users below the Admin/Maintainer privilege level. Other team-facing endpoints correctly apply this sanitization for observer-class roles. The target search endpoint (POST /api/latest/fleet/targets), which resolves hosts against a query, failed to apply the same field-level masking. Consequently, when an observer-class user issues a legitimate target search against an observer-runnable query, the API response includes the full, unmasked team configuration objects — including the team's enroll secret and the team's agent options block.

Data Exposed. Two categories of sensitive data are exposed:

1. Team enroll secrets — opaque strings used to authenticate new hosts during enrollment into a specific team. Possession of an enroll secret allows an attacker to enroll arbitrary, attacker-controlled hosts into the victim team, bypassing host-level access controls.
2. Credential-bearing agent options — the agent_options configuration can embed secrets such as AWS secret access keys, proxy authentication passwords, API tokens, or other credentials required for osquery to interact with cloud infrastructure or internal services. These are returned verbatim in the vulnerable response.

Attack Surface. The vulnerable surface is the authenticated Fleet API. The attacker requires only a low-privilege account (Observer, Observer+, or Technician) — roles commonly granted to auditors, junior analysts, or contractors. The attack vector is network-based (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N). Privileges required are low (PR:L). The confidentiality impact is high (C:H); integrity and availability are unaffected (I:N/A:N).

Root Cause Classification. This is an authorization/least-privilege enforcement flaw — specifically a failure to consistently apply a field-level masking policy across different API endpoints that return overlapping data models. The endpoint in question reuses a serialization path that bypasses the RBAC-aware masking logic applied elsewhere. CWE-200 (Exposure of Sensitive Information) captures the outcome; the underlying bug class is inconsistent access control policy enforcement across code paths.

Exploitation Scenarios

Note: No public PoC or exploit code is available; the attack chain below is inferred from the NVD description and the vulnerability class.

Step 1 — Reconnaissance / Target Identification. An attacker with valid credentials for an Observer, Observer+, or Technician role enumerates the Fleet API. They confirm the target Fleet instance version is below 4.87.0 (e.g., via the /api/latest/fleet/version endpoint or software banner). They identify the teams available to them and craft or reuse an observer-runnable query (queries that the observer role is permitted to execute on hosts).

Step 2 — Triggering the Flaw. The attacker sends a POST request to /api/latest/fleet/targets (the exact endpoint named in the NVD description) with a valid observer-runnable query in the body. Because the endpoint lacks the sanitization that masks enroll secrets and agent options for low-privilege roles, the API response includes the full, unmasked team objects.

Step 3 — Payload / Execution Method (Vulnerability-Class Level). This is not an injection or memory-corruption issue — the "payload" is simply a crafted API request. The attacker does not need to bypass authentication; they are authorized to reach the endpoint. The flaw is that the authorization check at the endpoint level does not cascade to field-level data masking. The attacker's malicious input is minimal: a valid query string and target selection.

Step 4 — Post-Exploitation Impact. With the leaked enroll secret, the attacker enrolls unauthorized hosts into the affected team. This enables:

• Deployment of malicious osquery configurations to those hosts.
• Potential lateral movement if the enrolled hosts are positioned inside the enterprise network with access to internal resources.
• With leaked agent_options credentials (AWS secret access keys, proxy passwords), the attacker gains direct access to cloud infrastructure or internal proxy services — potentially escalating from low-privilege Fleet user to cloud account compromise.

Inevitability of Discovery. The attack requires no special tooling — standard API clients (curl, Postman, Burp Suite) suffice. The likely discovery path was API fuzzing or privilege-differential testing comparing endpoint responses between admin and observer roles.

Impact Assessment

Business Impact. This vulnerability undermines the trust boundary between low-privilege and high-privilege data in a device management platform. Fleet is an administrative control plane — it manages endpoint security posture. Exposure of enroll secrets and cloud credentials from this plane is high-severity for organizations where Fleet is integrated with cloud workloads. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects: network attack surface, low complexity, low privilege requirement, no user interaction, high confidentiality impact, no integrity or availability impact.

Affected Systems. Any self-hosted Fleet instance running version < 4.87.0. Fleet Cloud customers are affected if the service is operated on vulnerable versions (vendor roll-out dependent). Organizations that:

• Use team-scoped observer accounts for external auditors or contractors,
• Store credentials in agent options (AWS keys, proxy auth, API tokens),
• Rely on enroll secrets to control host admission, are at highest risk.

Blast Radius. The disclosure of a team enroll secret enables unauthorized host enrollment. The severity escalates if the victim Fleet instance is configured with cloud provider integrations where agent options carry long-lived credentials (AWS secret access keys, proxy passwords). In such cases, an observer-class user — the most restricted API role — can exfiltrate production cloud credentials. Given the attacker requires only a low-privilege account, organizations with many observer-scoped users (e.g., SOC analysts, MSSP contractors) face a proportionally larger attack surface.

CISA KEV. Not listed. No known active exploitation in the wild as of the report date.

Detection Guidance

The following detection rules focus on the two observable signals: (1) unusual volume or pattern of requests to the vulnerable endpoint from low-privilege accounts, and (2) network traffic to/from Fleet API returning abnormally large response payloads that may contain secrets.

Sigma Rule

title: Fleet Target Search Endpoint - Sensitive Data Disclosure Attempt
id: f9cecb2e-1f1a-4a5a-9e3d-7a1f8b6d2c41
status: experimental
description: >
  Detects repeated POST requests to the Fleet target search endpoint
  (POST /api/latest/fleet/targets) by low-privilege roles (Observer,
  Observer+, Technician), which may indicate an attempt to exploit
  CVE-2026-48786 to retrieve unmasked team enroll secrets and agent options.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-48786
logsource:
  category: web
  product: fleet
  definition: 'HTTP access logs or reverse proxy logs for Fleet API'
detection:
  selection:
    cs-method: 'POST'
    cs-uri-path: '/api/latest/fleet/targets'
  filter_normal_usage:
    cs-username|startswith:
      - 'admin'
      - 'maintainer'
  filter_internal_ip:
    c-ip:
      - '127.0.0.1'
      - '::1'
  condition: selection and not filter_normal_usage and not filter_internal_ip
  timeframe: 5m
level: medium
falsepositives:
  - Legitimate target search usage by observers for standard host queries
  - Automated compliance tooling using observer accounts
fields:
  - cs-username
  - c-ip
  - cs-uri-path
  - sc-bytes
tags:
  - attack.t1213
  - cve.2026.48786
  - cwe.200

YARA Rule

rule Fleet_Sensitive_Data_Disclosure_CVE_2026_48786
{
    meta:
        author = "Valters IT Security"
        description = "Detects API responses containing Fleet team enroll secrets and agent options leaked via target search endpoint"
        date = "2026-01-01"
        cve = "CVE-2026-48786"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-48786"
        score = 70

    strings:
        $endpoint = "fleet/targets"
        $enroll_secret_key = "\"enroll_secret\""
        $agent_options = "\"agent_options\""
        $aws_access_key = "AKIA[0-9A-Z]{16}"
        $proxy_password = "proxy_password"
        $response_json = "\"teams\""

    condition:
        (uint16(0) == 0x5B7B or uint16(0) == 0x7B7B) and
        any of ($endpoint, $response_json) and
        ($enroll_secret_key or $agent_options) and
        any of ($aws_access_key, $proxy_password) and
        filesize < 10MB
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"Fleet CVE-2026-48786 - Target Search Endpoint Sensitive Data Disclosure"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/latest/fleet/targets"; http.uri; nocase; http.response_body; content:"enroll_secret"; http.response_body; content:"agent_options"; http.response_body; content:"teams"; classtype:attempted-recon; sid:202648786001; rev:1; reference:cve,2026-48786; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-48786; metadata:created_at 2026-01-01, updated_at 2026-01-01;)

alert http any any -> $HOME_NET any (msg:"Fleet CVE-2026-48786 - Large Response with Credential Patterns to Low Privilege User"; flow:established,to_server; http.uri; content:"/api/latest/fleet/targets"; http.uri; nocase; http.response_body; content:"AKIA"; http.response_body; content:"proxy_password"; http.response_body; content!"error"; threshold:type both, track by_src, count 1, seconds 60; classtype:policy-violation; sid:202648786002; rev:1; reference:cve,2026-48786; metadata:created_at 2026-01-01, updated_at 2026-01-01;)

Elastic Detection

// Elastic EQL - Detect low-privilege users submitting multiple target search requests
sequence by user.name with maxspan=10m
  [network where process.name : "*fleet*" or
     http.request.method == "POST" and
     url.path == "/api/latest/fleet/targets" and
     user.roles : ("observer", "observer+", "technician", "*observer*", "*technician*")
  ]
  [network where http.response.status_code == 200 and
     http.response.bytes > 10000 and
     user.roles : ("observer", "observer+", "technician", "*observer*", "*technician*")
  ]

Splunk SPL Query

index=web sourcetype=access_combined
| where match(_raw, "POST /api/latest/fleet/targets")
| search user!="admin" AND user!="maintainer" 
| stats count by user, src_ip, _time
| where count > 5
| table _time, user, src_ip, count
| sort -count
| eval alert="Possible CVE-2026-48786 exploitation - repeated low-privilege target search requests"

Wazuh OSSEC Rule

<group name="fleet,">
    <rule id="100487" level="12">
        <decoded_as>json</decoded_as>
        <field name="method">POST</field>
        <field name="url">/api/latest/fleet/targets</field>
        <match>enroll_secret</match>
        <match>agent_options</match>
        <description>Fleet CVE-2026-48786: low-privilege user may have retrieved unmasked team secrets via target search endpoint</description>
        <group>cve_2026_48786,</group>
        <mitre>
            <id>T1213</id>
        </mitre>
        <options>no_full_log</options>
    </rule>

    <rule id="100488" level="10">
        <decoded_as>json</decoded_as>
        <field name="method">POST</field>
        <field name="url">/api/latest/fleet/targets</field>
        <match>AKIA</match>
        <description>Fleet CVE-2026-48786: AWS credential pattern detected in target search response body</description>
        <group>cve_2026_48786,</group>
        <mitre>
            <id>T1213</id>
        </mitre>
        <options>no_full_log</options>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Status. Patch confidence: 0/4 — UNPATCHED, no patch evidence from any tracked source. The NVD description states the issue is "fixed in version 4.87.0"; however, no vendor advisory, changelog entry, or commit reference has been indexed by any of the tracked patch sources at the time of writing. The fix status is therefore reported as unverified.

1) Immediate Mitigations (while awaiting patch confirmation or upgrade):

• Restrict observer-class roles. Audit all Observer, Observer+, and Technician accounts. Where feasible, temporarily downgrade or suspend accounts that do not require API access to the target search functionality.
• Network-level restriction. Place the Fleet API behind a reverse proxy that enforces allowlisting for sensitive endpoints; consider blocking POST /api/latest/fleet/targets from non-admin IP ranges temporarily.
• Credentials rotation. If there is any indication that agent options contain live credentials (AWS keys, proxy passwords, API tokens) and observer accounts have accessed the target search endpoint, rotate those credentials immediately. Assume exposure until proven otherwise.
• Monitor aggressively. Deploy the detection rules above and review historical access logs for observer-scoped requests to /api/latest/fleet/targets.
• Temporarily disable team enroll secrets. If feasible, rotate enroll secrets and disable automatic enrollment until the instance is patched.

2) Patch/Upgrade Steps.

• Upgrade Fleet to version 4.87.0 or later as soon as the vendor formally releases the fix. Verify the upgrade through the vendor's changelog.
• If the upstream fix is verified and applied, test that the target search endpoint now masks enroll secrets and agent options for observer-class roles (privilege-differential test against an admin account).
• For Fleet-hosted/cloud customers: verify with vendor that managed instances are running 4.87.0+.

3) Long-Term Hardening.

• Least privilege enforcement. Review Fleet role definitions and ensure no unnecessary exposure of sensitive data fields to observer roles. Enforce the principle that only Admin/Maintainer roles may view enroll secrets and agent options.
• Credential hygiene. Avoid embedding long-lived credentials in osquery agent options. Prefer short-lived credentials, secret managers, or credential injection at deployment time.
• Regular privilege-differential security testing. Periodically compare API responses between privilege levels across all endpoints to catch serialization/masking inconsistencies like this one before attackers do.
• Enable audit logging. Ensure Fleet audit logs capture all API request/response activity from low-privilege roles for forensics.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-48786
2. Fleet Documentation — Roles & Permissions (reference for role model): https://fleetdm.com/docs/using-fleet/rbac
3. Fleet GitHub Repository (issue tracker for CVE-2026-48786 follow-up): https://github.com/fleetdm/fleet
4. CWE-200 — Exposure of Sensitive Information: https://cwe.mitre.org/data/definitions/200.html
5. ATT&CK Technique T1213 — Data from Information Repositories: https://attack.mitre.org/techniques/T1213/

Threat Actor Activity / Exploit-in-the-Wild Evidence: No known threat actor campaigns or active exploitation in the wild have been reported as of the writing of this report. The vulnerability is not listed in CISA KEV. The PoC/exploit status is None — no public exploit code or Nuclei templates exist at this time. Attack chain is inferred from vulnerability class.