{"id":"CVE-2026-101046","aliases":["EUVD-2026-87977","GHSA-qhx2-24jf-9jj9","GHSA-rxhg-vcww-2mpw","GO-2026-6269"],"status":"published","title":"Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints","description":"Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities). The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key into the SQL ORDER BY clause without an allowlist, so an authenticated user with read access to Activity could order results by arbitrary columns. The impact is read-only and bounded to columns on the activity_past table that are not otherwise returned in these responses (e.g. details), allowing their values to be inferred through the resulting sort order; there is no write access, privilege escalation, or reachability of node_key or other host-join columns through these endpoints. Fixed in 4.89.0, which removes the deprecated helper and passes the sort column through SanitizeColumn.","severity":{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00171,"percentile":0.06477,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2026-08-20T18:44:36Z","modified":"2026-10-28T02:30:48Z","fixes":[{"ecosystem":"Go","package":"github.com/fleetdm/fleet/v4","fixed_in":["4.89.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/fleetdm/fleet/v4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.89.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/fleetdm/fleet/v4","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.89.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/fleetdm/fleet/v4","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.89.0"}]}]}],"products":[{"vendor":"fleetdm","product":"fleet"}],"references":[{"url":"https://github.com/fleetdm/fleet/security/advisories/GHSA-rxhg-vcww-2mpw","tags":["vendor-advisory","Vendor Advisory","Mitigation","advisory","web"]},{"url":"https://www.vulncheck.com/advisories/fleet-before-4.89.0-sql-injection-via-order-by-activity-endpoints","tags":["third-party-advisory","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101046","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-qhx2-24jf-9jj9"},{"url":"https://github.com/fleetdm/fleet/releases/tag/fleet-v4.89.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rxhg-vcww-2mpw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101046.json","tags":["advisory"]},{"url":"https://github.com/fleetdm/fleet","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-101046","title":"Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints","description":"Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities). The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key into the SQL ORDER BY clause without an allowlist, so an authenticated user with read access to Activity could order results by arbitrary columns. The impact is read-only and bounded to columns on the activity_past table that are not otherwise returned in these responses (e.g. details), allowing their values to be inferred through the resulting sort order; there is no write access, privilege escalation, or reachability of node_key or other host-join columns through these endpoints. Fixed in 4.89.0, which removes the deprecated helper and passes the sort column through SanitizeColumn.","status":"published","published":"2026-09-27T17:02:35.154Z","modified":"2026-09-28T13:16:02.557Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low","assessor":"cna"},{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:20:09.808851Z"}],"euvd":[{"id":"EUVD-2026-87977","description":"Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities). The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key into the SQL ORDER BY clause without an allowlist, so an authenticated user with read access to Activity could order results by arbitrary columns. The impact is read-only and bounded to columns on the activity_past table that are not otherwise returned in these responses (e.g. details), allowing their values to be inferred through the resulting sort order; there is no write access, privilege escalation, or reachability of node_key or other host-join columns through these endpoints. Fixed in 4.89.0, which removes the deprecated helper and passes the sort column through SanitizeColumn.","status":"published","published":"2026-09-27T17:02:35Z","modified":"2026-09-28T13:16:02Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T17:27:53.908541Z"}],"ghsa":[{"id":"GHSA-qhx2-24jf-9jj9","title":"Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET ...","description":"Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities). The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key into the SQL ORDER BY clause without an allowlist, so an authenticated user with read access to Activity could order results by arbitrary columns. The impact is read-only and bounded to columns on the activity_past table that are not otherwise returned in these responses (e.g. details), allowing their values to be inferred through the resulting sort order; there is no write access, privilege escalation, or reachability of node_key or other host-join columns through these endpoints. Fixed in 4.89.0, which removes the deprecated helper and passes the sort column through SanitizeColumn.","status":"published","published":"2026-09-27T18:30:23Z","modified":"2026-09-27T18:30:30Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"},{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:12:31.359269Z"},{"id":"GHSA-rxhg-vcww-2mpw","title":"Fleet: ORDER BY column injection on activity list endpoints","description":"### Summary\n\nAn authenticated user with read access to Activity could influence the `ORDER BY` clause of the activity list endpoints by supplying an arbitrary sort column:\n\n- `GET /api/v1/fleet/activities` (`ListActivities`)\n- `GET /api/v1/fleet/hosts/{id}/activities` (`ListHostPastActivities`)\n\nThis originated from the deprecated cursor-pagination helper (`appendListOptionsWithCursorToSQL`), which interpolated the caller-supplied order key into SQL without an allowlist. The original report's `node_key` extraction scenario (`/api/v1/fleet/labels/{id}/hosts`) was remediated separately in #44385; these two activity endpoints were the residual call sites, neither of which joins the `hosts` table, so `node_key` was never reachable through them.\n\n### Impact\n\nRead-only. Because the order key was interpolated, an authenticated user with Activity read could sort by columns not otherwise returned in these responses. The exposure was bounded to columns on `activity_past` (e.g. `details` on `/api/v1/fleet/activities`, which is not in that endpoint's SELECT; host-only activities are already excluded by `WHERE host_only = false`). There is no privilege escalation, write access, or reachability of `node_key` or other host-join columns through these endpoints.\n\n### Remediation\n\nThe deprecated helper was removed from the codebase. Both endpoints now pass the caller-supplied sort column through `SanitizeColumn`, which strips all characters except `[\\w-.]` and backtick-quotes each identifier segment. This closes the injection vector: separators, whitespace, parentheses, and quotes cannot survive sanitization, so an expression-based `ORDER BY` oracle is not constructable.\n\n### Affected versions\n\n`\u003c fleet-v4.89.0`. Fixed in `fleet-v4.89.0`.\n\n### Credit\n\nThanks to @axel-corsiez for the report.","status":"published","published":"2026-08-20T18:44:36Z","modified":"2026-08-20T18:44:39Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:41:04.755504Z"}],"nvd":[{"id":"CVE-2026-101046","description":"Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities). The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key into the SQL ORDER BY clause without an allowlist, so an authenticated user with read access to Activity could order results by arbitrary columns. The impact is read-only and bounded to columns on the activity_past table that are not otherwise returned in these responses (e.g. details), allowing their values to be inferred through the resulting sort order; there is no write access, privilege escalation, or reachability of node_key or other host-join columns through these endpoints. Fixed in 4.89.0, which removes the deprecated helper and passes the sort column through SanitizeColumn.","status":"published","published":"2026-09-27T18:16:31.037Z","modified":"2026-10-07T17:33:07.173Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:52.081323Z"}],"osv":[{"id":"CVE-2026-101046","title":"Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints","description":"Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities). The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key into the SQL ORDER BY clause without an allowlist, so an authenticated user with read access to Activity could order results by arbitrary columns. The impact is read-only and bounded to columns on the activity_past table that are not otherwise returned in these responses (e.g. details), allowing their values to be inferred through the resulting sort order; there is no write access, privilege escalation, or reachability of node_key or other host-join columns through these endpoints. Fixed in 4.89.0, which removes the deprecated helper and passes the sort column through SanitizeColumn.","status":"published","published":"2026-09-27T17:02:35.154Z","modified":"2026-10-28T02:30:48.571528919Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:44:53.83521Z"},{"id":"GHSA-rxhg-vcww-2mpw","title":"Fleet: ORDER BY column injection on activity list endpoints","description":"### Summary\n\nAn authenticated user with read access to Activity could influence the `ORDER BY` clause of the activity list endpoints by supplying an arbitrary sort column:\n\n- `GET /api/v1/fleet/activities` (`ListActivities`)\n- `GET /api/v1/fleet/hosts/{id}/activities` (`ListHostPastActivities`)\n\nThis originated from the deprecated cursor-pagination helper (`appendListOptionsWithCursorToSQL`), which interpolated the caller-supplied order key into SQL without an allowlist. The original report's `node_key` extraction scenario (`/api/v1/fleet/labels/{id}/hosts`) was remediated separately in #44385; these two activity endpoints were the residual call sites, neither of which joins the `hosts` table, so `node_key` was never reachable through them.\n\n### Impact\n\nRead-only. Because the order key was interpolated, an authenticated user with Activity read could sort by columns not otherwise returned in these responses. The exposure was bounded to columns on `activity_past` (e.g. `details` on `/api/v1/fleet/activities`, which is not in that endpoint's SELECT; host-only activities are already excluded by `WHERE host_only = false`). There is no privilege escalation, write access, or reachability of `node_key` or other host-join columns through these endpoints.\n\n### Remediation\n\nThe deprecated helper was removed from the codebase. Both endpoints now pass the caller-supplied sort column through `SanitizeColumn`, which strips all characters except `[\\w-.]` and backtick-quotes each identifier segment. This closes the injection vector: separators, whitespace, parentheses, and quotes cannot survive sanitization, so an expression-based `ORDER BY` oracle is not constructable.\n\n### Affected versions\n\n`\u003c fleet-v4.89.0`. Fixed in `fleet-v4.89.0`.\n\n### Credit\n\nThanks to @axel-corsiez for the report.","status":"published","published":"2026-08-20T18:44:36Z","modified":"2026-09-28T03:55:39.119389082Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:56.639206Z"},{"id":"GO-2026-6269","title":"Fleet: ORDER BY column injection on activity list endpoints in github.com/fleetdm/fleet","description":"Fleet: ORDER BY column injection on activity list endpoints in github.com/fleetdm/fleet","status":"published","published":"2026-08-25T15:00:02Z","modified":"2026-09-28T03:55:39.119389082Z","updated_at":"2026-11-02T15:47:03.11707Z"}]}}