Fleet is an open-source device management platform used to manage and monitor endpoints. In versions before 4.80.1, a vulnerability (CVE-2026-27465) exists in the configuration API that returns sensitive Google Calendar service account credentials to any authenticated user, including those assigned the lowest privilege role, 'Observer'. The API endpoint responsible for returning configuration data fails to obfuscate or redact the private key material associated with the Google Calendar service account. This flaw stems from CWE-201, which involves the insertion of sensitive information into sent data. As a result, low-privilege users can retrieve the private key and potentially use it to access Google Calendar resources or other Google Workspace assets linked to the compromised service account. Importantly, this vulnerability does not allow attackers to escalate privileges within Fleet or interfere with device management capabilities. The flaw is addressed in Fleet version 4.80.1, which properly restricts access to sensitive credentials. No known exploits are currently reported in the wild. The CVSS 4.0 base score is 1.3, reflecting low severity due to limited impact scope and the requirement for authenticated access.

The primary impact is unauthorized disclosure of sensitive Google service account credentials to low-privilege authenticated users within Fleet. This could lead to unauthorized access to Google Calendar data or other Google Workspace resources associated with the service account, potentially exposing sensitive organizational scheduling information or other integrated data. However, since the vulnerability does not allow privilege escalation within Fleet or access to device management functions, the risk is contained to the Google Workspace environment linked to the service account. Organizations relying on Fleet’s Google Calendar integration could face confidentiality breaches of calendar data, which might affect operational security and privacy. The impact is mitigated if the Google Calendar integration is not used or if credentials are rotated promptly after exposure. The vulnerability requires authenticated access, limiting exposure to internal or trusted users with Fleet accounts.

Administrators should upgrade Fleet to version 4.80.1 or later, which patches the vulnerability by properly restricting access to sensitive Google service account credentials. If immediate upgrading is not feasible, the Google Calendar integration should be disabled or removed from Fleet to prevent exposure. Additionally, affected Google service account credentials must be rotated immediately to invalidate any potentially compromised keys. Organizations should audit user roles and permissions within Fleet to ensure that only necessary users have access, minimizing the risk of credential exposure. Monitoring and logging access to the configuration API endpoint can help detect any unauthorized attempts to retrieve sensitive data. Finally, organizations should review their Google Workspace audit logs for unusual access patterns linked to the service account to identify potential misuse.