Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.1
Fleet SQL injection in API allows attackers to access sensitive data
CVE-2026-26186
GHSA-49xw-vfc4-7p43
Summary
A security flaw in Fleet's software API allows attackers to inject malicious code and access sensitive information. This can happen when a user with permission accesses a specific endpoint and provides a specially crafted request. To protect against this, Fleet users should limit access to trusted users and ensure that any user input is properly validated.
What to do
- Update github.com fleetdm to version 4.80.1.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| github.com | fleetdm | <= 4.80.1 | 4.80.1 |
| fleetdm | fleet | <= 4.80.1 | – |
Original title
Fleet has an SQL Injection vulnerability via backtick escape in ORDER BY parameter
Original description
### Summary
A SQL Injection vulnerability in Fleet’s software versions API allowed authenticated users to inject arbitrary SQL expressions via the `order_key` query parameter. Due to unsafe use of `goqu.I()` when constructing the `ORDER BY` clause, specially crafted input could escape identifier quoting and be interpreted as executable SQL.
### Impact
An authenticated attacker with access to the affected endpoint could inject SQL expressions into the underlying MySQL query. Although the injection occurs in an `ORDER BY` context, it is sufficient to enable blind SQL injection techniques that can disclose database information through conditional expressions that affect result ordering. Crafted expressions may also cause excessive computation or query failures, potentially leading to degraded performance or denial of service.
No direct evidence of reliable data modification or stacked query execution was demonstrated.
### Workarounds
If an immediate upgrade is not possible, users should restrict access to the affected endpoint to trusted roles only and ensure that any user-supplied sort or column parameters are strictly allow-listed at the application or proxy layer.
### For more information
If there are any questions or comments about this advisory:
Email fleet at [[email protected]](mailto:[email protected])
Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)
### Credits
We thank @fuzzztf for responsibly reporting this issue.
A SQL Injection vulnerability in Fleet’s software versions API allowed authenticated users to inject arbitrary SQL expressions via the `order_key` query parameter. Due to unsafe use of `goqu.I()` when constructing the `ORDER BY` clause, specially crafted input could escape identifier quoting and be interpreted as executable SQL.
### Impact
An authenticated attacker with access to the affected endpoint could inject SQL expressions into the underlying MySQL query. Although the injection occurs in an `ORDER BY` context, it is sufficient to enable blind SQL injection techniques that can disclose database information through conditional expressions that affect result ordering. Crafted expressions may also cause excessive computation or query failures, potentially leading to degraded performance or denial of service.
No direct evidence of reliable data modification or stacked query execution was demonstrated.
### Workarounds
If an immediate upgrade is not possible, users should restrict access to the affected endpoint to trusted roles only and ensure that any user-supplied sort or column parameters are strictly allow-listed at the application or proxy layer.
### For more information
If there are any questions or comments about this advisory:
Email fleet at [[email protected]](mailto:[email protected])
Join #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)
### Credits
We thank @fuzzztf for responsibly reporting this issue.
nvd CVSS3.1
8.8
nvd CVSS4.0
5.1
Vulnerability type
CWE-89
SQL Injection
Published: 26 Feb 2026 · Updated: 12 Mar 2026 · First seen: 6 Mar 2026