Threats tagged 'ghsa-88p2-jj8w-j8qg'

A vulnerability in Fleet versions prior to 4.87.0 allowed low-privilege observer-class users to access unmasked team enroll secrets and credential-bearing configuration via the target search endpoint. This flaw exposed sensitive information such as AWS secret access keys and proxy passwords. The issue was due to insufficient sanitization on the target search endpoint, unlike other team-facing endpoints that masked these fields for observers. The vulnerability is fixed in version 4.87.0.