Skip to content
OpenAdvisories
Medium WID-SEC-2026-1896 2 CVEs

Fleet: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen

Published Jun 11, 2026 · Updated Aug 26, 2026 · Revision 2 · de-DE

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Fleet ausnutzen, um Informationen offenzulegen.

Product

Fleet ist eine Open-Source-Plattform zur Geräteverwaltung, die es Unternehmen ermöglicht, ihre Infrastruktur zu überwachen und zu sichern.

Vulnerabilities 2

  • Medium 6.5
    CVE-2026-46370

    Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint

    Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoint (GET /api/v1/fleet/labels/{id}/hosts) allowed an authenticated user with the lowest-privilege Observer role to extrac…

    fleetdm fleet github.com/fleetdm/fleet/v4 Go
  • Medium 6.5
    CVE-2026-46371

    Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint

    Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the Apple MDM commands listing endpoint (GET /api/v1/fleet/mdm/apple/commands) allowed an authenticated user with the lowest-privilege Observer role t…

    fleetdm fleet github.com/fleetdm/fleet/v4 Go

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-66671, EUVD-2026-66667

  2. #1

    Initiale Fassung

References