Unrated

Fleet Observer ORDER BY oracle secret extraction

IdentifiersCVE-2026-46370CWE-203

CVE-2026-46370 is an information disclosure vulnerability in Fleet affecting the labels host-listing endpoint. According to the provided advisory, an authenticated user with Global Observer or Team Observer privileges can abuse an ORDER BY oracle in that endpoint to infer sensitive host enrollment secrets, including node_key and orbit_node_key, one character at a time. The issue allows low-privileged observer-role users to extract secrets that should not be exposed through query behavior, indicating a side-channel/oracle condition in server-side query handling or response differentiation tied to ORDER BY processing.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an authenticated Observer-level attacker to recover host enrollment secrets such as node_key and orbit_node_key. With those secrets, the attacker can impersonate enrolled hosts, submit falsified query results and inventory data, retrieve pending scripts and MDM commands intended for those hosts, and poison compliance and policy results. This can undermine host trust, fleet integrity, and downstream operational decisions based on compromised telemetry.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, limit Observer-role access to fully trusted users only, since exploitation requires authenticated Global Observer or Team Observer privileges. Monitor for suspicious access patterns against the labels host-listing endpoint, and rotate potentially exposed node_key and orbit_node_key values by re-enrolling affected hosts. Reducing observer access and secret lifetime lowers the risk until a fixed release is deployed.

Remediation

Patch, then assume compromise.

Upgrade Fleet to a vendor-fixed release. The provided advisory states that v4.85.0 is listed under patches and that affected versions are before 4.84.2. Organizations should deploy a fixed version from the vendor and re-enroll affected hosts as needed to rotate any exposed enrollment secrets, particularly node_key and orbit_node_key.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

FleetdmFleetapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

No public activity tracked yet. Mallory keeps watching.

0 SOURCESView more in app

No public activity observed for this vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity