CVE-2026-101046 Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpoints
An authenticated user can exploit SQL injection in Fleet activity endpoints to infer values of hidden columns via sort order manipulation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-101046?
CVE-2026-101046 is a low-severity SQL injection vulnerability in fleetdm fleet, published on 27 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities). The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the caller-supplied sort/order key into the SQL ORDER BY clause without an allowlist, so an authenticated user with read access to Activity could order results by arbitrary columns. The impact is read-only and bounded to columns on the activity_past table that are not otherwise returned in these responses (e.g. details), allowing their values to be inferred through the resulting sort order; there is no write access, privilege escalation, or reachability of node_key or other host-join columns through these endpoints. Fixed in 4.89.0, which removes the deprecated helper and passes the sort column through SanitizeColumn.
Weakness: CWE-89
Which versions are affected by CVE-2026-101046?
3 open source packages ship an affected version, including github.com/fleetdm/fleet/v4. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/fleetdm/fleet/v4 Go | All versions | 4.89.0 |
github.com/fleetdm/fleet/v4 Go | All versions | 4.89.0 |
github.com/fleetdm/fleet/v4 Go | All versions | 4.89.0 |
Products include Fleetdm Fleet.
How do I fix CVE-2026-101046?
Upgrade github.com/fleetdm/fleet/v4 to 4.89.0 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-101046 being exploited?
There is no known exploitation of CVE-2026-101046 in the wild and no public exploit code.
Other vulnerabilities in fleetdm fleet
- CVE-2020-26276 SAML authentication vulnerability in Fleet
- CVE-2026-103264 Fleet before 4.87.0 Authentication Bypass via Device Identifiers
- CVE-2026-23518 Fleet has a JWT signature bypass vulnerability in Azure AD MDM enrollment
- CVE-2026-26062 Fleet server may terminate unexpectedly when handling certain gRPC requests
- CVE-2026-26061 Fleet's unbounded request body read allows remote Denial of Service
Sources
Also known as GHSA-qhx2-24jf-9jj9, GHSA-rxhg-vcww-2mpw, GO-2026-6269.