CVE-2026-101046: fleetdm fleet SQL Injection

Vulnerability summary

CVE-2026-101046 is a medium (CVSS 4.3) SQL Injection vulnerability in fleetdm fleet. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6% of scored vulnerabilities.

Timeline

1. 27-09-2026
   PublishedVulnerability first disclosed.
2. 28-09-2026
   Last modifiedVulnerability information updated.

Description

Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities). The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key into the SQL ORDER BY clause without an allowlist, so an authenticated user with read access to Activity could order results by arbitrary columns. The impact is read-only and bounded to columns on the activity_past table that are not otherwise returned in these responses (e.g. details), allowing their values to be inferred through the resulting sort order; there is no write access, privilege escalation, or reachability of node_key or other host-join columns through these endpoints. Fixed in 4.89.0, which removes the deprecated helper and passes the sort column through SanitizeColumn.

• CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.