Description

A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings.The proxy configuration possibly contains proxy authentication credentials and private key material that they should not be authorized to view.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-13T20:17:27.530Z",
  "pubdate": "2026-08-13T20:17:27.530Z",
  "executiveSummary": "An authorization bypass vulnerability exists in the Fleet management functionality where a lower-privileged user holding only agent policy read privileges can access the complete configuration of a configured Fleet proxy.\nThis vulnerability leads to an unauthorized information disclosure impact, exposing sensitive artifacts such as proxy authentication credentials and private key material.\nThe affected systems involve components managing Fleet proxy configurations and settings.\nThe risk implications are severe, as unauthorized actors can harvest sensitive cryptographic keys and authentication tokens, potentially facilitating lateral movement, man-in-the-middle capabilities, or unauthorized access to upstream resources.\nThe attacker capabilities are limited to users authenticated with the specific lower privilege of reading agent policies.\nExploitation requirements dictate that the adversary must already possess read access to agent policies within the affected system, allowing them to leverage logic flaws in authorization boundaries to retrieve data normally restricted to the Fleet privilege level required for reading general settings.",
  "technicalDetails": "The root cause of this vulnerability lies in a broken object level authorization or an overly permissive access control implementation within the Fleet proxy configuration retrieval mechanism.\nSpecifically, the application fails to adequately validate whether the requesting security context holds the elevated Fleet privilege to read settings, mistakenly permitting access based solely on the presence of lower-privileged permissions required to read agent policies.\nThe vulnerable component is the configuration retrieval endpoint or function responsible for serving Fleet proxy settings to authenticated users.\nThe privilege requirements involve a low-privileged authenticated user who possesses strictly agent policy read capabilities, bypassing the intended security boundary that restricts access to administrative settings.\nThe attack flow begins when an authenticated adversary with agent policy read privileges issues a request to access or query the Fleet proxy configuration.\nDue to the improper authorization checks, the backend service processes the request without enforcing the mandatory Fleet settings read privilege.\nUpon successful query execution, the application returns the full configuration payload of the Fleet proxy to the unauthorized requester.\nThe payload behavior and post-exploitation impact include the extraction of sensitive data contained within the proxy configuration.\nThis exposed material encompasses plaintext or reversibly encoded proxy authentication credentials and cryptographic private key material.\nAn attacker can exploit these harvested credentials and private keys to impersonate proxies, intercept traffic, authenticate against upstream systems with stolen privileges, or compromise downstream agent communications."
}