Executive brief
A vulnerability in Fleet, an open-source device management platform, allows low-privileged users to extract sensitive information such as host enrollment secrets and notification tokens. By exploiting a flaw in how the system lists Apple MDM commands, an attacker could impersonate managed devices, submit fake data, or retrieve pending scripts. This could lead to unauthorized access to managed computers and the ability to interfere with corporate device security policies.
Technical details
The `GET /api/v1/fleet/mdm/apple/commands` endpoint is vulnerable to a blind SQL injection (specifically an ORDER BY oracle). The endpoint uses a deprecated helper that fails to validate the `order_key` parameter against an allowlist, allowing it to reference any column in the joined `hosts` and `nano_enrollments` tables. An authenticated attacker with Observer-level privileges can use the `after` pagination parameter to perform a binary search, extracting sensitive values like `node_key` or `orbit_node_key` character-by-character based on the presence or absence of results. Successful exploitation allows host impersonation and retrieval of pending MDM commands. The issue is fixed in version 4.84.2.
Affected products
- Fleet Device Management (FleetDM) Fleet <= 4.84.1
Timeline
- 2026-06-11: disclosed
- 2026-06-11: advisory
- 2026-06-12: patched: Version 4.84.2 released