CyberRota Analysis
AI-GeneratedThe target search endpoint in Fleet versions prior to 4.87.0 exposes unmasked team enroll secrets and full team configurations to low-privilege users, such as those with Observer or Technician roles. This vulnerability allows an authenticated attacker to enroll unauthorized hosts and potentially access sensitive credentials, including AWS keys and proxy passwords. Organizations using Fleet should prioritize upgrading to version 4.87.0 to mitigate the risk of unauthorized access and credential leakage.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint (POST /api/latest/fleet/targets) returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-class users. Other team-facing endpoints mask these fields for observers, but the target search endpoint did not apply the same sanitization, so an authenticated user with the Observer, Observer+, or Technician role, whether global or team-scoped, could retrieve the secrets and agent options by performing a target search against an observer-runnable query. With a leaked team enroll secret an attacker could enroll unauthorized hosts into the affected team, and if the team's agent options contained credentials such as AWS secret access keys or proxy passwords, those values were disclosed as well. This issue is fixed in version 4.87.0.