Fleet's GET /api/v1/fleet/labels/{id}/hosts endpoint used a deprecated helper that did not restrict columns allowed in the ORDER BY clause. Authenticated users with Global or Team Observer roles could supply sensitive column names such as h.node_key as the order_key parameter. By combining this with the cursor-based after parameter, they could perform a binary search oracle attack to extract the node_key and orbit_node_key values one character at a time. These keys are long-lived secrets used by osquery and Orbit agents to authenticate to the Fleet server. Extracting these keys allows impersonation of enrolled hosts, submission of fabricated data, retrieval of pending commands, and poisoning of compliance and policy results. The vulnerability affects Fleet versions prior to 4.84.2 and is fixed in 4.85.0.

The vulnerability allows an authenticated user with Observer-level privileges to extract sensitive host enrollment secrets (node_key and orbit_node_key) that are used for authenticating osquery and Orbit agents to the Fleet server. An attacker with these secrets can impersonate hosts, submit false query results and inventory data, retrieve pending scripts and MDM commands, and manipulate compliance and policy outcomes. Although exploitation requires authenticated Observer access, the exposed secrets are high-value and long-lived, posing a significant risk if Observer roles are assigned to untrusted users.

A patch is available in Fleet version 4.85.0 and should be applied to remediate this vulnerability. Until the upgrade can be performed, administrators should restrict the Observer role to fully trusted users to reduce risk. Additionally, for any hosts suspected of exposure, the node_key and orbit_node_key should be rotated by re-enrolling the affected hosts.