Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints

Description

Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities). The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key into the SQL ORDER BY clause without an allowlist, so an authenticated user with read access to Activity could order results by arbitrary columns. The impact is read-only and bounded to columns on the activity_past table that are not otherwise returned in these responses (e.g. details), allowing their values to be inferred through the resulting sort order; there is no write access, privilege escalation, or reachability of node_key or other host-join columns through these endpoints. Fixed in 4.89.0, which removes the deprecated helper and passes the sort column through SanitizeColumn.

Scores

EPSS (exploitation in 30 days)

0.17% · top 94% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 2.3.

Weakness

• CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (opens in a new tab)All about CWE-89 and its CVEs

Affected products

• fleetdm · fleet

  • affected < 4.89.0
  • unaffected 4.89.0

References (2)

• GitHub Security Advisory (GHSA-rxhg-vcww-2mpw) (opens in a new tab)vendor-advisory
• VulnCheck Advisory: Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-101046](https://trackcve.app/badge/CVE-2026-101046.svg)](https://trackcve.app/cve/CVE-2026-101046)

Record last updated 28 Sept 2026, 13:16 UTC.