Fleet, an open-source device management platform built on osquery, had a security flaw (CVE-2026-48786) in versions before 4.87.0 where the POST /api/latest/fleet/targets endpoint returned unmasked team enroll secrets and full team configuration, including credentials, to users with Observer, Observer+, or Technician roles. This occurred because the target search endpoint did not apply the same sanitization as other team-facing endpoints. An authenticated low-privilege user could retrieve these secrets by performing a target search against an observer-runnable query. Exposure of team enroll secrets could allow unauthorized host enrollment, and disclosure of credential-bearing agent options could leak sensitive credentials such as AWS secret access keys or proxy passwords. The issue has been addressed in version 4.87.0.

Low-privilege users with Observer-class roles could access sensitive team enroll secrets and credential-bearing configuration data, potentially allowing unauthorized host enrollment and exposure of sensitive credentials. This could lead to unauthorized access to managed devices and compromise of cloud or proxy credentials. The vulnerability does not affect availability or integrity but has a high confidentiality impact.

Upgrade Fleet to version 4.87.0 or later where this issue is fixed. The vendor has provided an official fix. No additional mitigation steps are indicated.