Vulnerability · Published Sep 27, 2026 · Assigned by VulnCheck
CVE-2026-101046Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints
Low 3.1
In plain English
A low-severity SQL injection in fleet from fleetdm. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities). The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key into the SQL ORDER BY clause without an allowlist, so an authenticated user with read access to Activity could order results by arbitrary columns. The impact is read-only and bounded to columns on the activity_past table that are not otherwise returned in these responses (e.g. details), allowing their values to be inferred through the resulting sort order; there is no write access, privilege escalation, or reachability of node_key or other host-join columns through these endpoints. Fixed in 4.89.0, which removes the deprecated helper and passes the sort column through SanitizeColumn.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/fleetdm/fleet/v4 | 4.89.0 | GHSA-rxhg-vcww-2mpw |
| Go | github.com/fleetdm/fleet/v4 | 4.89.0 | GO-2026-6269 |
Affected products (as reported)
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- GitHub Security Advisory (GHSA-rxhg-vcww-2mpw) vendor-advisory
- VulnCheck Advisory: Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints third-party-advisory