CVE-2026-27465: Securing Fleet Device Management Against Google Calendar Key Leaks

Fleet’s Open Secret: The Google Calendar Key Leak

Fleet Device Management version 4.80.1 addresses CVE-2026-27465, a vulnerability involving the exposure of Google Calendar Service Account private keys. Authenticated users with the ‘Observer’ role could retrieve full credentials via the global configuration API.

Why This Matters

While ideal security models assume strict role-based access control, the technical reality of implicit serialization in Go can lead to catch-all configuration buckets leaking sensitive data. This failure demonstrates how treating configuration data as a single object for API responses can bypass intended privilege boundaries, potentially allowing low-privileged users to impersonate service accounts in Google Cloud.

Key Insights

• Fleet versions prior to 4.80.1 leak unmasked credentials via the /api/v1/fleet/config endpoint (2026)
• Implicit JSON serialization in Go can inadvertently expose internal struct fields if not explicitly masked
• Low-privileged Observer accounts could exploit CWE-201 to gain High Confidentiality impact data
• The vulnerability is mitigated by implementing custom MarshalJSON logic to mask sensitive keys with asterisks
• Remediation requires both a software upgrade and the revocation of historically exposed keys in Google Cloud Console

Working Examples

Fixed sensitive credential disclosure in Google Calendar integration via custom JSON marshaling.

func (k GoogleCalendarApiKey) MarshalJSON() ([]byte, error) { if k.masked { return json.Marshal("********") } ... }

Practical Applications

• Use case: Fleet server deployment updating to 4.80.1 to prevent unauthorized access to Google Cloud resources. Pitfall: Failing to rotate exposed service account keys after patching allows continued use of compromised credentials.
• Use case: Go developers using custom MarshalJSON methods for sensitive configuration structs. Pitfall: Relying on default serialization for complex objects sent to low-privilege API consumers.

References:

• https://dev.to/cverports/cve-2026-27465-fleets-open-secret-the-google-calendar-key-leak-53jb