CVE-2026-46371: Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint

June 12, 2026

A vulnerability in Fleet’s Apple MDM commands listing endpoint allowed authenticated users with the lowest-privilege Observer role to extract sensitive values from joined database tables — including host enrollment secrets and Apple Push Notification Service (APNS) tokens — through a cursor-based binary search oracle. The endpoint accepted a user-supplied order_key parameter that was not validated against a column allowlist.

References

github.com/advisories/GHSA-x4qr-qw6h-wvxq
github.com/fleetdm/fleet/security/advisories/GHSA-x4qr-qw6h-wvxq
nvd.nist.gov/vuln/detail/CVE-2026-46371

Code Behaviors & Features

Detect and mitigate CVE-2026-46371 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →