Fleet's Apple MDM commands endpoint (GET /api/v1/fleet/mdm/apple/commands) used a deprecated query helper that did not restrict columns allowed in the ORDER BY clause. Because the query joins hosts and nano_enrollments tables, an authenticated user with Observer role could supply any column as order_key and use cursor-based pagination to infer sensitive values one character at a time via a binary search oracle. Extracted secrets include node_key and orbit_node_key, which enable impersonation of enrolled hosts to Fleet's osquery and Orbit endpoints. APNS tokens could also be extracted but require possession of the APNS certificate to exploit. This issue affects Fleet versions before 4.84.2 and requires Apple MDM enabled with at least one queued command. Instances without Apple MDM configured are not affected.

An attacker with Observer-level access can extract sensitive enrollment secrets and APNS tokens from the database, potentially allowing impersonation of hosts and submission of fabricated data to Fleet endpoints. This could lead to unauthorized command execution or data manipulation within the Fleet environment. However, exploitation requires valid Observer credentials and Apple MDM configuration with queued commands. APNS token exploitation additionally requires the organization's APNS certificate.

A patch is available in Fleet version 4.84.2 that addresses this vulnerability. Administrators should upgrade to version 4.84.2 or later to remediate the issue. Until the patch can be applied, restrict the Observer role to fully trusted users and rotate node_key and orbit_node_key for any hosts suspected of exposure by re-enrolling them.