Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-101046: Fleet lets attackers infer hidden activity data via sorting

CVE-2026-101046 · published 22 days ago

Summary

The Fleet management software (versions before 4.89.0) lets a logged‑in user who can view activity logs change the column used for sorting the results. By choosing a column that isn’t normally shown, the user can deduce the hidden values based on the order of the list. Updating Fleet to version 4.89.0 or later resolves the issue.

What to do

Update fleetdm github.com/fleetdm/fleet/v4 to version 4.89.0.
Update fleetdm fleet to version 4.89.0 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Go	fleetdm	github.com/fleetdm/fleet/v4	< 4.89.0 Fix: upgrade to 4.89.0
–	fleetdm	fleet	< 4.89.0

Original advisory text

Fleet: ORDER BY column injection on activity list endpoints

Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities). The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key into the SQL ORDER BY clause without an allowlist, so an authenticated user with read access to Activity could order results by arbitrary columns. The impact is read-only and bounded to columns on the activity_past table that are not otherwise returned in these responses (e.g. details), allowing their values to be inferred through the resulting sort order; there is no write access, privilege escalation, or reachability of node_key or other host-join columns through these endpoints. Fixed in 4.89.0, which removes the deprecated helper and passes the sort column through SanitizeColumn.

References

https://github.com/fleetdm/fleet/security/advisories/GHSA-rxhg-vcww-2mpw Vendor Advisory Mitigation
https://www.vulncheck.com/advisories/fleet-before-4.89.0-sql-injection-via-order... Third Party Advisory
https://github.com/fleetdm/fleet Product
https://github.com/fleetdm/fleet/releases/tag/fleet-v4.89.0 URL

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

2.3 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-89SQL Injection

Timeline

Published27 Sep 2026

Updated19 Oct 2026

First seen27 Sep 2026

Sources

CVE-2026-101046 · NVD

GHSA-rxhg-vcww-2mpw · OSV

CVE-2026-101046 · MITRE

Track software like this

Free during beta