What is the CVSS score of EUVD-2026-66657?

EUVD-2026-66657 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for EUVD-2026-66657?

Yes, a patch is available for EUVD-2026-66657. Update the affected software to the latest version immediately.

FleetDM Fleet EUVD-2026-66657

| CVE-2026-48786 MEDIUM

Information Exposure (CWE-200)

2026-08-12 https://github.com/fleetdm/fleet

GHSA-88p2-jj8w-j8qg

Information Disclosure Suse

6.5

CVSS 3.1 · Vendor: https://github.com/fleetdm/fleet

Severity by source

Vendor (https://github.com/fleetdm/fleet) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

PR:L confirmed by Observer/Technician role requirement; C:H justified by full cleartext exposure of team secrets and embedded cloud credentials; no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (https://github.com/fleetdm/fleet).

CVSS VectorVendor: https://github.com/fleetdm/fleet

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Aug 12, 2026 - 16:11 vuln.today

Analysis Generated

Aug 12, 2026 - 16:11 vuln.today

DescriptionCVE.org

Summary

The target search endpoint (POST /api/latest/fleet/targets) returned team enroll secrets and full team configuration, including credential-bearing agent options, to observer-class users. Other team-facing endpoints mask these fields for observers; the target search endpoint did not apply the same sanitization.

Impact

An authenticated user with Observer, Observer+, or Technician role (global or team-scoped) could retrieve unmasked team enroll secrets and team agent options by performing a target search against an observer-runnable query.

With a leaked team enroll secret, an attacker could enroll unauthorized hosts into the affected team. If the team's agent options contained credentials such as AWS secret access keys or proxy passwords, those values were also exposed.

Patches

v4.87.0

Workarounds

If an immediate upgrade is not possible, administrators should:

Rotate team enroll secrets for any team that may have been exposed
Rotate any credentials stored in team agent options (AWS keys, proxy passwords, session tokens)
Restrict Observer and Technician roles to fully trusted users until the patch is applied

Credits

Fleet thanks @fuzzztf for responsibly reporting this issue.

For more information

If there are any questions or comments about this advisory:

Send an email to [security@fleetdm.com](mailto:security@fleetdm.com) Join #fleet in osquery Slack

AnalysisAI

FleetDM Fleet's target search endpoint (POST /api/latest/fleet/targets) fails to apply the same field-masking logic used by other team-facing API endpoints, exposing unmasked team enroll secrets and credential-bearing agent options to any authenticated Observer, Observer+, or Technician user before v4.87.0. The practical blast radius extends well beyond information disclosure: leaked enroll secrets allow unauthorized hosts to be enrolled into affected teams, and if agent options contain embedded AWS secret access keys, proxy passwords, or session tokens, those credentials are also retrieved in cleartext. No public exploit code has been identified at time of analysis, though the vulnerability is trivially reproducible by any low-privileged Fleet user.

Technical ContextAI

Fleet is an open-source device management and security telemetry platform built on osquery, implemented in Go (CPE: pkg:go/github.com/fleetdm/fleet/v4). The platform enforces role-based access control with roles including Admin, Maintainer, Observer, Observer+, and Technician. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the POST /api/latest/fleet/targets handler omitted the sanitization middleware that other team-scoped endpoints apply to strip sensitive fields before returning responses to observer-class roles. Team enroll secrets and agent options - which can carry cloud provider credentials such as AWS secret access keys or proxy authentication tokens - were returned verbatim in the API response. This is an authorization bypass at the serialization/response layer rather than the storage layer.

RemediationAI

Vendor-released patch: v4.87.0. Administrators should upgrade Fleet to version 4.87.0 or later immediately, as detailed in the release notes at https://github.com/fleetdm/fleet/releases/tag/fleet-v4.87.0. If an immediate upgrade is not feasible, Fleet recommends rotating all team enroll secrets for any team whose data may have been exposed to observer-class users - note that rotation invalidates existing enrolled host tokens and may require re-enrollment of affected endpoints. Additionally, rotate any credentials stored in team agent options (AWS secret access keys, proxy passwords, session tokens) and treat those credentials as fully compromised. As a role-based compensating control, restrict Observer, Observer+, and Technician role assignments to fully trusted personnel until the patch is applied; however, this control has operational trade-offs if broad read-only access is required for reporting or compliance workflows. The vendor advisory is at https://github.com/fleetdm/fleet/security/advisories/GHSA-88p2-jj8w-j8qg.