The target search endpoint (`POST /api/latest/fleet/targets`) in Fleet v4 before version 4.87.0 returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to users with Observer-class roles. While other team-facing endpoints properly masked these sensitive fields for observers, this endpoint did not, allowing an authenticated user with Observer, Observer+, or Technician roles (global or team-scoped) to retrieve these secrets by performing a target search. Exposure of team enroll secrets could enable unauthorized host enrollment, and leaked credentials such as AWS secret access keys or proxy passwords could lead to further compromise. The issue is tracked as CVE-2026-48786 and has a CVSS 3.1 score of 6.5 (medium severity).

Authenticated users with Observer, Observer+, or Technician roles can access sensitive team enroll secrets and credential-bearing configuration data that should have been masked. This exposure allows unauthorized enrollment of hosts into the affected team and disclosure of sensitive credentials stored in team agent options, such as AWS keys and proxy passwords. There is no indication of active exploitation in the wild.

An official patch is available in Fleet version 4.87.0 that fixes this issue. Administrators should upgrade to version 4.87.0 or later to remediate the vulnerability. If immediate upgrade is not possible, administrators should rotate all team enroll secrets and any credentials stored in team agent options that may have been exposed. Additionally, restrict Observer and Technician roles to fully trusted users until the patch is applied.